🔍 TEE-TA 脆弱性解析レポート

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/alloc_key_data_to_wrap (call-site):2777

フェーズ: ['unknown']

詳細: ["Call-site binding: 'head' parameter aliases key->attributes (TA-private object attributes containing private key parts).", "Call-site binding: 'data' parameter is &key_data (TA-private out pointer) provided by caller.", "Call-site binding: 'sz' parameter is &key_sz (TA-private size out parameter) from caller."]

ルール: other

['rc = encode_rsa_private_key_der(head, data, sz);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:34

フェーズ: ['unknown']

詳細: ['computes buf_len from (*head)->attrs_size and then serializes into buffer without explicit capacity check of destination, relying on serialize to enforce bounds', 'Computes buf_len from (*head)->attrs_size and serializes into buffer without an explicit capacity check local to caller; relies on serialize to enforce safety.']

ルール: weak_input_validation

['buf_len = sizeof(struct obj_attrs) + (*head)->attrs_size; ... rc = serialize(bstart, &buf_len, data, size);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:54

フェーズ: ['unknown']

詳細: ['updates (*head)->attrs_size by adding user-controlled size without additional validation; may corrupt internal bookkeeping if size is tainted']

ルール: other

['(*head)->attrs_size += 2 * sizeof(uint32_t) + size;']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:55

フェーズ: ['unknown']

詳細: ['Updates (*head)->attrs_size by adding size; untrusted size can cause overflow or incorrect size accounting if not validated']

ルール: weak_input_validation

['(*head)->attrs_size += 2 * sizeof(uint32_t) + size;']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:72

フェーズ: ['unknown']

詳細: ['Loop bound uses h->attrs_size derived from head; if attrs_size is corrupted by input, loop may OOB or mis-parse entries']

ルール: weak_input_validation

['for (; cur < end; cur += next_off) {']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:75

フェーズ: ['unknown']

詳細: ["Binding: destination &pkcs11_ref is local (TEE-private) while source 'cur' derives from *head memory whose provenance is caller-controlled/unknown", 'Reads attribute header from cur via TEE_MemMove into local pkcs11_ref; source (cur) may be in REE-derived buffer', 'Reads attribute header from cur (possibly REE-derived) into local pkcs11_ref via TEE_MemMove; source provenance uncertain', 'Fixed-size header read from REE-derived region without explicit check that remaining bytes >= header size.', 'Reads attribute header from cur into local pkcs11_ref using TEE_MemMove where pkcs11_ref.size is later used to compute next_off; size originates from memory and is only implicitly bounded by end', 'Reads attribute header from untrusted memory into local pkcs11_ref via TEE_MemMove; pkcs11_ref.size then controls subsequent offsets without strong bounds before use', 'Binding: destination &pkcs11_ref originates as callee-local (TEE-private) while source cur is buffer derived from head; record aliasing of pointers at call-site', 'Reading pkcs11_ref from attrs buffer where pkcs11_ref.size influences offsets without explicit bounds validation.', 'Reads attribute header from untrusted blob (cur) to compute next_off and then uses it to bound memmove without verifying next_off fits within remaining attrs; attacker-controlled size can cause out-of-bounds behavior.', 'dst (&pkcs11_ref) is a local TA buffer while src (cur) points into obj_attrs blob derived from caller; binding of callee params to their origins.', 'Reading attribute header from untrusted blob without checking header fits within remaining attrs_size.', 'Copies attribute header from parsed buffer into local pkcs11_ref; source buffer provenance unclear (could be REE-origin), sizes derived from parsed data', 'parses pkcs11_ref.size from in-memory data and uses it to compute next_off and loop bounds without strong validation against h->attrs_size', 'copies header at cur into local pkcs11_ref using size derived from in-memory data; parsed size later used to compute offsets without stronger validation', 'Copies attribute header from cur without verifying there are sizeof(pkcs11_ref) bytes remaining; header.size is then trusted', "Binding: destination '&pkcs11_ref' is a local TA stack object (TA-private) at call site", "Copies header from 'cur' without first confirming sizeof(header) bytes remain; header.size then influences parsing", 'Uses pkcs11_ref.size read from buffer at cur to compute next_off and as a memmove length without validating it against attrs_size, enabling out-of-bounds/mis-sized moves', 'dest (&pkcs11_ref) is TA-local but src (cur) may be REE-derived buffer; binding of destination to caller origin recorded']

ルール: other, weak_input_validation

['TEE_MemMove(&pkcs11_ref, cur, sizeof(pkcs11_ref));', 'TEE_MemMove(&pkcs11_ref, cur, sizeof(pkcs11_ref)); next_off = sizeof(pkcs11_ref) + pkcs11_ref.size;', 'TEE_MemMove(cur, cur + next_off, end - (cur + next_off));']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:84

フェーズ: ['unknown']

詳細: ['Uses pkcs11_ref.size (derived from memory within h, potentially attacker-controlled) to compute next_off and perform an in-place TEE_MemMove without an explicit upper bound on next_off', 'Uses pkcs11_ref.size-derived next_off to compute an in-place memmove length (end - (cur + next_off)) without an explicit upper bound on pkcs11_ref.size', 'In-place memmove shifts trailing attributes within head buffer (cur <- cur+next_off) where buffer may be REE-visible and next_off is derived from REE-controlled size field without independent bounds validation', 'In-place shift of trailing attributes (cur <- cur+next_off) uses next_off derived from REE-controlled size field without an independent bound check', 'In-place shift within REE-visible buffer uses next_off derived from REE-controlled pkcs11_ref.size without independent validation, enabling overwrite.', 'Shifts tail data left with TEE_MemMove(cur, cur + next_off, end - (cur + next_off)) using next_off derived from untrusted attribute size; may under/overlap and affects attrs_size/count', 'Shifts tail data left using length computed from next_off derived from untrusted attribute size; overlapping move within same buffer may be unsafe if sizes are malicious', 'Binding: dest cur and src cur+next_off are pointers into the same attrs buffer (aliasing); length depends on untrusted header-derived next_off', 'Tail data moved using next_off derived from untrusted header, enabling overlapping/unsafe moves and attrs_size/count modifications.', 'In-place memmove shifts remaining attributes using attacker-influenced next_off derived from pkcs11_ref.size; insufficient explicit bounds/sanity checks on pkcs11_ref.size.', 'Copies remainder of attribute list using next_off computed from untrusted pkcs11_ref.size without strong sanity checks; len expression may be attacker-controlled causing OOB or logic errors.', 'In-place shift of attribute bytes uses next_off from untrusted header without sufficient validation, risking OOB.', 'in-place TEE_MemMove shifts remaining attributes using sizes derived from parsed pkcs11_ref and h->attrs_size; malformed sizes could cause incorrect memory shifts', 'In-place shift of trailing attributes using length computed from parsed headers; malformed pkcs11_ref.size or attrs_size may cause incorrect move', 'In-place attribute shifting uses unvalidated next_off derived from pkcs11_ref.size; malformed sizes can cause incorrect memory moves.', 'in-place TEE_MemMove moves memory region (cur + next_off) to cur using length derived from end - (cur + next_off); if sizes miscomputed this can corrupt attribute list', 'in-place memmove shifts trailing bytes using length computed from end and next_off; miscomputed next_off can corrupt list (overlap/misbound copy)', 'Uses pkcs11_ref.size (from unvalidated header) to compute next_off and to memmove remaining bytes, enabling OOB reads/writes if header is malicious', "Binding: dest 'cur' and src 'cur + next_off' are pointers into the same attributes buffer (TA-private)", 'Moves remaining bytes based on next_off computed from untrusted header size; may underflow/overflow if header is malicious', 'memmove uses len computed from pkcs11_ref.size without prior robust validation against attrs_size, allowing out-of-bounds move']

ルール: weak_input_validation, shared_memory_overwrite, other

['TEE_MemMove(cur, cur + next_off, end - (cur + next_off));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:107

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'head' aliases caller-provided obj_attrs (TA-private attribute blob).", "Call-site binding: 'head' aliases callers' object attribute container (object state) and is used for internal parsing.", "Binding: 'head' originates from caller attributes container (may embed REE-derived template); used for pointer arithmetic to compute cur/end.", "alias of caller-provided 'head' passed into function; head typically originates from REE-derived template in higher-level callers", "Call-site binding: 'head' aliases caller-provided attributes structure which may be REE-originated or TA-private depending on caller"]

ルール: other

['char *cur = (char *)head + sizeof(struct obj_attrs);', 'void get_attribute_ptrs(struct obj_attrs *head, uint32_t attribute, void **attr, uint32_t *attr_size, size_t *count)']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:110

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'count' is used as input max_found and updated with number of matches found (caller-provided control value).", "Binding: 'count' is input/output controlling max_found and updated to actual found count; caller-provided value drives loop termination and outputs.", "Call-site binding: '*count' used as max_found; caller-provided count influences loop's early exit"]

ルール: other

['size_t max_found = *count; ... *count = found;', 'size_t max_found = *count;']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:112

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'attr' (attr_ptr) is an out-parameter that will be filled with pointers into TA-private storage.", "Binding: 'attr' is caller-supplied out-pointer array; pointers stored point into template region (cur + sizeof(pkcs11_ref)).", 'attr (out pointer) is alias-bound to caller storage; caller may supply TA or REE memory so origin is unknown', "Call-site binding: 'attr' output pointer is caller-supplied (may be NULL or point into caller stack/vars)"]

ルール: other

['if (attr) { if (pkcs11_ref.size) *attr_ptr++ = cur + sizeof(pkcs11_ref); else *attr_ptr++ = NULL; }', 'void **attr_ptr = attr;']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:113

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'attr_size' is updated with attribute sizes (TA-private metadata written out).", "Binding: 'attr_size' is caller-provided size array; receives pkcs11_ref.size values which influence upstream buffer checks.", 'attr_size (out pointer) is alias-bound to caller storage; sizes written derive from parsed pkcs11_ref.size which may be attacker-controlled if head is REE-derived', "Call-site binding: 'attr_size' output pointer is caller-supplied (may be NULL or point into caller memory)"]

ルール: other

['if (attr_size) *attr_size_ptr++ = pkcs11_ref.size;', 'uint32_t *attr_size_ptr = attr_size;']

関数: ['unknown', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:115

フェーズ: ['unknown']

詳細: ["Loop advances by next_off derived from pkcs11_ref.size read from data in 'head' without validating next_off before use; malformed attrs_size or pkcs11_ref.size can cause logic errors or overrun.", 'Loop advances by next_off computed from pkcs11_ref.size read from unvalidated data; malformed sizes can cause overruns or infinite loops.', 'pkcs11_ref.size (from unvalidated template bytes) is used to compute next_off and advance cur without an upper bound check, enabling out-of-bounds next_off', 'Computes next_off = sizeof(pkcs11_ref) + pkcs11_ref.size where pkcs11_ref.size is from untrusted bytes and not upper-bounded, enabling out-of-bounds advancement.', 'Reads attribute headers and uses pkcs11_ref.size to advance cur (next_off) without explicit check that cur+sizeof(pkcs11_ref) and cur+next_off are within bounds before the TEE_MemMove, risking out-of-bounds read if attrs_size is inconsistent.', 'Reads attribute header and uses header.size to advance without explicit pre-read bounds check; can cause out-of-bounds read.', 'Parses length-prefixed attributes using pkcs11_ref.size from buffer; if pkcs11_ref.size is attacker-controlled it may cause next_off or cur arithmetic to overflow/skip checks leading to panic/out-of-bounds', 'Loop computes next_off from pkcs11_ref.size (attacker-controlled) to advance cur; without robust range checks this can lead to mis-parsing, over-reads, or infinite loops.', 'loop advances by next_off derived from pkcs11_ref.size (input-controlled) without per-iteration validation against end until final check, enabling crafted attrs_size/size to cause mis-iteration', 'Loop advances by next_off computed from untrusted pkcs11_ref.size without validating each advancement against end, enabling mis-iteration or overshoot.']

ルール: weak_input_validation

['for (; cur < end; cur += next_off) { ... next_off = sizeof(pkcs11_ref) + pkcs11_ref.size; }', 'next_off = sizeof(pkcs11_ref) + pkcs11_ref.size;', 'TEE_MemMove(&pkcs11_ref, cur, sizeof(pkcs11_ref)); next_off = sizeof(pkcs11_ref) + pkcs11_ref.size;']

関数: ['TEE_MemMove', '=', 'unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:119

フェーズ: ['unknown']

詳細: ['Reads pkcs11_attribute_head from untrusted offsets inside head via TEE_MemMove without explicit validation of pkcs11_ref.size beyond loop bounds; malformed attrs_size could cause logic errors.', 'Reads pkcs11_attribute_head from memory at cur into local struct; pkcs11_ref.size later used to compute next_off without stronger validation of serialized contents.', 'TEE_MemMove reads pkcs11_attribute_head from cur; next_off uses pkcs11_ref.size for loop advance—size field influences control flow and can lead to overflow if corrupted.', 'Copies header from cur (inside object attribute blob) into local pkcs11_ref; size field from that header influences subsequent next_off arithmetic (control-flow influence).', 'Copies attribute header from serialized region into stack (TEE_MemMove) and uses pkcs11_ref.size to compute next_off without prior validation of size field, enabling out-of-bounds or integer overflow if input is malicious.', "Copies header from serialized region (src 'cur') into stack struct without validating pkcs11_ref.size before using it to compute next_off; malicious size may cause logic/integer errors or loop misbehavior.", 'Header copied from serialized region without validating remaining bytes; header.size later trusted to compute next_off.', 'Reads pkcs11_attribute_head from cur (TEE_MemMove) where cur is computed from head and head->attrs_size; pkcs11_ref.size (data-controlled) is used to compute next_off and loop progression', 'Copies serialized attribute header from buffer at cur into local pkcs11_ref; source buffer derived from head and head->attrs_size influences src bounds and is potentially attacker-controlled', 'Parses pkcs11_ref from serialized blob and uses pkcs11_ref.size to advance and to derive pointers; if pkcs11_ref.size is attacker-controlled, loop arithmetic and pointer arithmetic may be unsafe.', "Call-site binding: destination 'dest' parameter is &pkcs11_ref, a TA-stack buffer (local), so copy writes into TA-private memory.", "Call-site binding: source 'src' parameter aliases 'cur' which points into serialized attribute blob derived from head (origin: REE -> parsed into TA storage).", "Call-site binding: size 'n' is sizeof(pkcs11_ref) here but callers use variable sizes elsewhere; record that size parameter influences copy length.", 'Copies header from serialized blob into local struct and then uses parsed size to advance loop; if parsed size is attacker-controlled, parsing and subsequent arithmetic may be unsafe.', 'Parses header from serialized attributes and relies on parsed pkcs11_ref.size for loop arithmetic; attacker-controlled size can break bounds and lead to OOB reads.', "Copies bytes from 'cur' (pointer into serialized attribute blob derived from REE-supplied templates) into local pkcs11_ref; source is REE-influenced and used to compute next_off", 'Reads pkcs11_attribute_head from cur and uses pkcs11_ref.size to compute next_off without explicit overflow/malformed-field protection; malformed size could flow to next_off and loop control.', 'Call-site binding: dest parameter (&pkcs11_ref) is a caller stack object (TA-private) receiving bytes.', "Call-site binding: src parameter (cur) points into serialized attributes buffer from 'head' (TA-owned serialized region).", 'Copies header at cur into pkcs11_ref and then uses pkcs11_ref.size to compute next_off; malformed or attacker-controlled sizes in serialized data can cause logic errors.', "Copies bytes from buffer 'cur' (parsed from head, possibly REE-originated) into local structure via TEE_MemMove; source origin ambiguous and copy length is derived from fixed sizeof destination.", 'Destination &pkcs11_ref is a TA stack/local structure (TEE-private) being written by memmove from a pointer into serialized object data.', "Source 'cur' points inside serialized attributes buffer derived from head; origin is TA-managed serialized object storage (TEE-private).", 'TEE_MemMove reads a fixed-size header from cur without confirming that sizeof(pkcs11_ref) bytes remain in the serialized attributes buffer; next_off is computed from the unvalidated pkcs11_ref.size, risking over-read.', "Copies bytes from 'cur' (within serialized object storage) into local pkcs11_ref structure; source derives from head->attrs_size data and could be malformed leading to incorrect next_off computation.", 'TEE_MemMove reads attribute header from serialized object at cur; next_off uses parsed size to advance — malformed size can cause out-of-bounds advancement and triggers TEE_Panic check', 'Copies attribute header from serialized object (cur) into local pkcs11_ref on stack; both source and destination are TA-managed memory but malformed size in header drives next_off and loop progress.', 'Reading a fixed-size header from cur without verifying remaining bytes >= sizeof(pkcs11_ref); malformed pkcs11_ref.size then drives next_off and loop progression.', 'Copies pkcs11_attribute_head from cur using TEE_MemMove without validating cur against end other than loop condition; malformed attrs_size or pkcs11_ref.size can cause out-of-bounds or panic', 'Copies pkcs11_attribute_head from parsed buffer at cur into local pkcs11_ref using size sizeof(pkcs11_ref) while cur/end bounds depend on head->attrs_size which may be malformed or REE-influenced', 'TEE_MemMove copies pkcs11_attribute_head from cur without ensuring cur+sizeof(pkcs11_ref) <= end; malformed head->attrs_size or pkcs11_ref.size can cause OOB read or panic.', "Uses pkcs11_ref.size (from serialized data in head) to compute next_off and advance 'cur' without additional bounds validation beyond final check; malformed size could cause incorrect traversal.", "Reads pkcs11_ref from serialized 'cur' (potentially untrusted/malformed) into local structure without validating embedded size before use.", 'Reads header from serialized blob and uses its size field to advance traversal without validating header availability first.', 'Copies sizeof(pkcs11_ref) from cur (derived from head + offset) into local pkcs11_ref; cur/end arithmetic uses head->attrs_size which may be derived from untrusted serialized data.', "Call-site binding: destination '&pkcs11_ref' is a TA-local stack buffer written by TEE_MemMove.", "Call-site binding: source 'cur' points into head->attrs (TA-private blob) and is used as read source for memmove.", 'destination &pkcs11_ref is a local TA stack buffer (TEE-private) being written from src; alias/binding of dst parameter to a local struct.', "source 'cur' points into head-derived buffer; origin may be TA-private or derived from untrusted/template data (unknown provenance).", 'length argument is a constant sizeof(pkcs11_ref); binding of size parameter to this constant observed at call-site.', 'Reads attribute header via TEE_MemMove from cur (derived from head) and uses pkcs11_ref.size to compute next offset (TA memory-driven pointer arithmetic).', 'Reads attribute header from cur (derived from head + offset) into local pkcs11_ref; source is TA attribute storage computed from head->attrs_size.', 'Reads pkcs11_attribute_head from cur (derived from head buffer) into local struct via TEE_MemMove; fields (size/id) are attacker-controlled if head originates from REE.', "Copies pkcs11_attribute_head from buffer 'cur' (potentially REE-controlled) into local struct; fields like size/id are attacker-controllable.", "Binding: destination pointer '&pkcs11_ref' (callee dest) is a TA-local stack location passed to TEE_MemMove.", "Binding: source pointer 'cur' (callee src) points into object buffer that may originate from REE/shared memory.", 'Deserializes pkcs11_attribute_head from cur via TEE_MemMove; pkcs11_ref.size directly affects next_off and loop stepping without per-field validation', 'Deserializes pkcs11_attribute_head from cur into local struct; pkcs11_ref.size subsequently used to compute next_off without validating size field', 'Reads attribute header from cur into pkcs11_ref via TEE_MemMove and trusts pkcs11_ref.size to compute next_off without verifying header bounds beyond loop condition; malformed size could cause next_off to skip/overrun.', 'Reads attribute header from potentially REE-influenced buffer into pkcs11_ref and trusts pkcs11_ref.size to compute next_off without further validation.', 'Uses pkcs11_ref.size from serialized data to compute next_off and advance cur without validating size limits beyond end check; malformed size may cause logic errors.', 'TEE_MemMove reads a pkcs11_attribute_head from cur (parsed from head); that parsed header controls subsequent pointer arithmetic.', "Parses serialized attribute header by copying from 'cur' into local pkcs11_ref; src originates from head payload and controls next_off used for pointer arithmetic.", 'reads attribute header from cur and uses pkcs11_ref.size to compute next_off and to set pointers/sizes without fully validating that the computed offsets lie within end', 'Copies pkcs11_attribute_head from cur (derived from head which may contain REE-supplied data) into stack struct; size used later (pkcs11_ref.size) is attacker-influenced if cur is untrusted.', 'Reads attribute header from cur and uses pkcs11_ref.size to compute offsets without proving the header fully fits inside the remaining buffer; malformed attrs_size can trigger OOB read or panic.', 'Copies attribute header from cur then uses pkcs11_ref.size to compute next_off without validating that pkcs11_ref.size keeps cur within bounds (next_off influences loop advance)', "Copies attribute header from 'cur' (derived from head which may be REE-supplied) into local pkcs11_ref without validating pkcs11_ref.size before use", 'reads attribute header from cur and uses pkcs11_ref.size to compute next_off without fully validating that the claimed size keeps cur within end', 'Copies sizeof(pkcs11_ref) bytes from cur (pointer into head buffer, often REE-derived) into local pkcs11_ref without validating that remaining length >= sizeof(pkcs11_ref)', 'Reads header from cur and uses its size to advance without validating that header read and next_off remain within the serialized buffer; can cause OOB or panic.', 'Reads pkcs11_ref header from cur and uses pkcs11_ref.size to advance and to populate pointers without validating that size fits remaining buffer', 'Copies pkcs11_ref header from cur (parsed from head which may be REE-controlled) into local struct without validating remaining bytes against pkcs11_ref.size', 'reads attribute header via TEE_MemMove from cur (derived from head) and uses pkcs11_ref.size to compute next_off without ensuring sizeof(pkcs11_ref)+pkcs11_ref.size is within end', 'Copies sizeof(pkcs11_ref) from cur (derived from head which may be REE-controlled) into local pkcs11_ref; size and subsequent next_off use fields from untrusted data without robust validation', 'Reads header from serialized attributes and uses header.size to compute next offset without verifying header fits completely within remaining buffer.', 'Reads pkcs11_attribute_head from cur (derived from head) and uses pkcs11_ref.size to compute next offset and pointers without validating size vs remaining bytes', 'Copies pkcs11_attribute_head from cur (derived from head built from caller data) into local pkcs11_ref using size sizeof(pkcs11_ref) without validating that remaining bytes >= sizeof(pkcs11_ref)', 'reads attribute header from cur and uses pkcs11_ref.size to compute next_off and outputs without explicit validation that cur+next_off stays within end (panic if exceeded later)', 'copies sizeof(pkcs11_ref) from cur (derived from head which may be REE-supplied) into local structure without validating that cur+sizeof(pkcs11_ref) <= end beyond loop bound check', 'Reads attribute header from cur and uses pkcs11_ref.size to advance; no explicit check that sizeof(pkcs11_ref) bytes remain before read.', 'Parses length (pkcs11_ref.size) from data in head and uses it to compute next_off and result pointers without validating pkcs11_ref.size against remaining buffer, enabling out-of-bounds reads.', 'Copies sizeof(pkcs11_ref) bytes from cur (derived from head, potentially REE-controlled) into local pkcs11_ref; length fields read later (pkcs11_ref.size) are then trusted to compute offsets.', "Call-site binding: destination '&pkcs11_ref' is TA-private stack storage (receives data from src).", "Call-site binding: source 'cur' derives from head which may be REE-supplied, so memmove reads untrusted memory.", "Parses pkcs11_attribute_head from untrusted 'cur' via TEE_MemMove and uses pkcs11_ref.size without validating it sufficiently before pointer arithmetic", "Copies pkcs11_attribute_head from parsed buffer 'cur' (untrusted) into local struct and uses its size for arithmetic without strong validation", 'Reads pkcs11_attribute_head from cur (untrusted-derived buffer) via TEE_MemMove and uses pkcs11_ref.size to compute next_off without robust validation', 'Copies pkcs11_attribute_head from cur (template/blob derived from REE) into local pkcs11_ref using supplied length, trusting blob fields for subsequent size arithmetic', 'Copies attribute header bytes from template region (cur) into local pkcs11_ref on stack; source may originate from REE-derived serialized data.', 'reads attribute header from cur (derived from head which may be REE-supplied) and uses pkcs11_ref.size to compute next offset without ensuring sizeof(header)+size stays within end before use', 'Copies header from cur (derived from head which may be REE-supplied) into local pkcs11_ref and then uses pkcs11_ref.size to compute offsets without ensuring header+size fit before use', 'Reads header from untrusted serialized attributes buffer and uses its size field to compute offsets without validating header fits in remaining buffer.', 'Reads pkcs11_attribute_head from cur via TEE_MemMove and uses pkcs11_ref.size to compute next_off without validating remaining buffer length against pkcs11_ref.size', 'Reads attribute header from cur into pkcs11_ref and uses pkcs11_ref.size to compute offsets without validating remaining buffer length first', 'Reads pkcs11_attribute_head from potentially attacker-controlled template buffer via TEE_MemMove; pkcs11_ref.size used to advance loop and influence writes.', 'Destination &pkcs11_ref is a local stack object; callee will write into caller stack.', "Source 'cur' points inside template buffer derived from head; origin is head-based buffer (parsed data).", 'Reads pkcs11_attribute_head from cur with TEE_MemMove using size from ref data; insufficient validation that remaining bytes >= sizeof(header) before copy.', 'Copies pkcs11_attribute_head from cur into local struct without an explicit remaining-bytes check before the copy; cur derived from head->attrs_size.', 'Copies sizeof(pkcs11_ref) bytes from cur (pointer into head buffer) into local pkcs11_ref; src provenance (template bytes) is ambiguous', 'TEE_MemMove reads pkcs11_attribute_head from cur (derived from head) without explicit per-entry bounds check before using pkcs11_ref.size to compute next_off; later cur> end triggers panic but intermediate uses may dereference invalid lengths.', 'Copies pkcs11_attribute_head from cur (derived from head) without validating cur+sizeof(header) <= end before reading header->size, enabling malformed sizes to influence next_off.', 'Parses attribute headers from buffer using pkcs11_ref.size to compute next offset and pointer results; if headers are corrupted/malicious, loop arithmetic may be influenced.', "Call-site binding: destination &pkcs11_ref is a local stack object written from 'cur' (caller-controlled buffer region).", "Call-site binding: source 'cur' points into attribute buffer derived from head->attrs_size; origin may be attacker-influenced if head stems from REE.", 'Copies header then uses pkcs11_ref.size to compute next_off and pointers; malformed sizes in attributes can influence loop bounds and pointer arithmetic.', 'reads pkcs11_ref header from cur (derived from head) and uses pkcs11_ref.size to compute next_off and pointer writes without explicit check that sizeof(header)+size <= end', 'Copies header from cur (derived from head which may be REE-supplied) into local struct using sizeof(header) without proving that sizeof+payload fits before reading payload size', 'Header read uses pkcs11_ref.size to advance without prior validation that header+payload fit inside head->attrs_size.', 'Reads pkcs11_ref from cur and uses pkcs11_ref.size to compute next_off without validating that pkcs11_ref.size fits within remaining bytes', 'Reads header from cur (derived from head->attrs_size) and uses header.size to compute next offset without validating header.size against remaining bytes', 'Unvalidated read of header from serialized attributes where embedded size fields (pkcs11_ref.size) and remaining buffer length are not adequately checked.', 'Call-site binding: destination &pkcs11_ref is a local TA stack buffer (receives bytes copied by TEE_MemMove).', "Call-site binding: source 'cur' points into head->attrs storage (TA-private) and is read by TEE_MemMove.", 'Copies sizeof(pkcs11_ref) from cur without an explicit pre-check that cur+sizeof(pkcs11_ref) is <= end on the exact read site.', 'Reads pkcs11_ref from object memory and uses pkcs11_ref.size to advance cur (next_off) without explicit upper-limit on pkcs11_ref.size, risking out-of-bounds if attrs_size is corrupted.', "Call-site binding: destination '&pkcs11_ref' is a caller stack buffer (TA-private) receiving data copied from object memory.", "Call-site binding: source 'cur' points into object attribute storage (head+offset) which is TA-private memory.", 'Uses pkcs11_ref.size (read from src) to compute next_off without constraining pkcs11_ref.size against remaining attrs_size; a corrupted size can cause out-of-bounds reads.', 'Reads header then uses header.size to compute next_off without validating size against remaining attrs_size.', 'parsing uses pkcs11_ref.size from buffer to compute next_off and pointer targets without validating size bounds or provenance', 'Copies header from buffer at cur using size from code; pkcs11_ref.size later used to compute offsets without validating that size is sane or provenance of cur', "Copies bytes from 'cur' (pointer into attribute buffer possibly derived from REE) into local pkcs11_ref struct; src is REE-derived so could be attacker-controlled", 'Reads pkcs11_attribute_head from cur using TEE_MemMove; cur is derived from head->attrs_size and may be attacker-controlled leading to malformed sizes/next_off', 'Copies bytes from cur (derived from head, potentially REE-supplied) into local pkcs11_ref on stack; source provenance uncertain', 'Parsing loop uses sizes from serialized attributes (possibly REE-controlled) to derive next offsets; malformed sizes may drive out-of-bounds reads or large jumps.', 'Reads attribute header from cur (derived from head + offset) with TEE_MemMove using attacker-controlled offsets/size; pkcs11_ref.size then drives next_off without validation.', 'Copies header from cur (derived from head+offset where head.attrs_size is attacker-influenced) into pkcs11_ref using len sizeof(pkcs11_ref) while next_off is computed from untrusted pkcs11_ref.size.', 'Copies header from cur (possibly REE-derived shared buffer) into stack struct pkcs11_ref, binding shared src into TA-private destination']

ルール: weak_input_validation, other

['TEE_MemMove(&pkcs11_ref, cur, sizeof(pkcs11_ref));', 'TEE_MemMove(&pkcs11_ref, cur, sizeof(pkcs11_ref)); next_off = sizeof(pkcs11_ref) + pkcs11_ref.size;', 'next_off = sizeof(pkcs11_ref) + pkcs11_ref.size;']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:120

フェーズ: ['unknown']

詳細: ['Computes next_off = sizeof(pkcs11_ref) + pkcs11_ref.size derived from data in memory; if pkcs11_ref.size is corrupted this can misadvance cur causing out-of-bounds or infinite loop.', 'Computes next_off = sizeof(pkcs11_ref) + pkcs11_ref.size from data read by line 119; corrupted size can misadvance cur causing out-of-bounds or infinite loop.', 'pkcs11_ref.size (from the copied header) is used to compute next_off and drive loop advancement; if pkcs11_ref.size is corrupted, parsing can exceed bounds or trigger panic.', 'Uses pkcs11_ref.size (read from serialized data) to compute next_off and to set attr_size; untrusted size can influence pointer arithmetic and later copies', 'pkcs11_ref.size from serialized data is used to compute next_off and later as reported attr_size; untrusted size can influence pointer arithmetic and later copies', 'Uses pkcs11_ref.size (from untrusted input) to compute next_off and advance cur, enabling input-driven out-of-bounds pointer arithmetic.', 'Uses attacker-controlled pkcs11_ref.size to compute next_off and advance cur, enabling input-driven out-of-bounds arithmetic.', 'Computes next_off = sizeof(pkcs11_ref) + pkcs11_ref.size from unvalidated pkcs11_ref.size; if pkcs11_ref.size is large it may make cur advance past end leading to panic.', 'Computes next_off = sizeof(pkcs11_ref) + pkcs11_ref.size from untrusted pkcs11_ref.size without validating it against remaining buffer, enabling cursor overrun.', 'Parsed pkcs11_ref.size from untrusted data is used to compute next_off and later pointer writes without validation, enabling further OOB when malformed.', 'Uses pkcs11_ref.size (from untrusted header) to compute next_off and advance parsing pointer; a crafted size can cause out-of-bounds advancement or TEE_Panic.', 'Uses pkcs11_ref.size (from untrusted bytes) in next_off arithmetic (cur += next_off), enabling out-of-bounds/oversize traversal if manipulated', 'Uses pkcs11_ref.size (from untrusted blob) in next_off arithmetic enabling out-of-bounds traversal if manipulated.', 'Uses untrusted pkcs11_ref.size to compute next_off and advance cur without validating remaining buffer length first.', 'Computes next_off = sizeof(pkcs11_ref) + pkcs11_ref.size where pkcs11_ref.size is from parsed buffer; a crafted size could cause loop misbehavior or overflow.', 'Computed next_off uses pkcs11_ref.size from parsed header; a crafted size may cause loop misbehavior or arithmetic overflow leading to out-of-bounds.', 'pkcs11_ref.size (from serialized data) is used to compute next_off without validating it against remaining buffer, enabling loop-control manipulation.', "pkcs11_ref.size from the copied header is used to compute next_off and advance 'cur' without sanitizing size; malformed sizes can corrupt loop bounds and subsequent pointer math.", 'Uses pkcs11_ref.size (from untrusted data) to compute next_off for loop advancement without validating that next_off keeps cur within bounds.', 'Uses pkcs11_ref.size (from untrusted input) to compute next_off without validating it keeps cur within bounds, enabling overflow/panic.']

ルール: other, weak_input_validation

['next_off = sizeof(pkcs11_ref) + pkcs11_ref.size;']

関数: ['=', 'unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:130

フェーズ: ['unknown']

詳細: ["Writes out pointers into the serialized buffer (cur + sizeof(pkcs11_ref)) into caller-provided attr array; these pointers alias into head's memory", "Writes out pointers into caller-provided attr array pointing inside serialized blob; these alias into head's memory and rely on head being well-formed", 'Assigns out pointers into regions computed from cur (cur + sizeof(pkcs11_ref)), exposing pointers into internal attribute storage to the caller via attr.', 'Assigns pointers into internal attribute storage to out-parameters (attr), exposing internal pointers to callers in TA context.', "Out-parameters 'attr' and 'attr_size' are populated with pointers/sizes derived from head; these pointers later escape to callers.", 'assigns pointers (cur + sizeof(pkcs11_ref)) into output attr array when pkcs11_ref.size claimed by head may be attacker-controlled', 'Writes pointers into attr/attr_size arrays based on cur + sizeof(pkcs11_ref) where cur is derived from head (caller-controlled); resulting pointers may point into untrusted regions.', 'Populates attr_size out-entries from pkcs11_ref.size which later callers use for bounds checks; correctness depends on pkcs11_ref.size integrity', 'Assigns pointers into attribute storage (cur + sizeof(pkcs11_ref)) into caller-supplied array without verifying overall array capacity (max_found), potential write-past of attr buffer.', 'Assigns pointers into attribute storage into caller-supplied array attr_ptr without explicit verification of caller-supplied array capacity (max_found).', 'assigns pointers into head buffer (possibly shared) into caller-provided attr array without verifying that resulting pointers are safe or canonical', 'Assigns pointers into parsed head buffer into caller-provided attr array without validating that resulting pointers are within bounds or originate from safe memory.']

ルール: other, weak_input_validation

['*attr_ptr++ = cur + sizeof(pkcs11_ref);', 'if (attr) { if (pkcs11_ref.size) *attr_ptr++ = cur + sizeof(pkcs11_ref); else *attr_ptr++ = NULL; } if (attr_size) *attr_size_ptr++ = pkcs11_ref.size;', 'if (attr) { if (pkcs11_ref.size) *attr_ptr++ = cur + sizeof(pkcs11_ref); else *attr_ptr++ = NULL; }', '*attr_ptr++ = cur + sizeof(pkcs11_ref); *attr_size_ptr++ = pkcs11_ref.size;', 'if (attr_size) *attr_size_ptr++ = pkcs11_ref.size;']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:131

フェーズ: ['unknown']

詳細: ["Writes pointers into caller-provided 'attr' array pointing into serialized attribute payload (exposes TEE-private addresses/content to caller context within TA flow).", 'Writes pointers into caller-provided attr array pointing into serialized payload; relies on pkcs11_ref.size and offsets computed earlier.', "Assigns pointers into the serialized attribute buffer (cur + sizeof(pkcs11_ref)) into attr array; these pointers alias into head's memory", "Assigns pointers into the serialized attribute buffer into attr array; these pointers alias into head's memory and may point into attacker-controlled serialized data", 'Stores pointers (cur + sizeof(pkcs11_ref)) into caller-supplied attr array; if head is REE-originated these pointers reference shared memory', 'Assigns pointers into the attributes blob (cur + sizeof(pkcs11_ref)) into caller-supplied attr array; these pointers alias into template-derived memory', 'Assigns pointers into the attributes blob (cur + sizeof(pkcs11_ref)) into caller-supplied attr array; these pointers alias into template-derived memory.']

ルール: other

['*attr_ptr++ = cur + sizeof(pkcs11_ref);', 'if (pkcs11_ref.size) *attr_ptr++ = cur + sizeof(pkcs11_ref); else *attr_ptr++ = NULL;']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:132

フェーズ: ['unknown']

詳細: ['Stores pointers into attr array that point inside the head buffer (cur + sizeof(pkcs11_ref)); these pointers may reference shared/REE-originated memory.', 'Stores pointers into attr array that point inside the head buffer; these may reference REE-originated memory.']

ルール: other

['*attr_ptr++ = cur + sizeof(pkcs11_ref);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:137

フェーズ: ['unknown']

詳細: ['Writes attribute sizes (pkcs11_ref.size) into caller-provided attr_size array; sizes derived from serialized data affect downstream bounds checks and copies', 'Writes attribute sizes (pkcs11_ref.size) into caller attr_size array; sizes originate from untrusted attribute metadata', 'Writes attribute sizes (pkcs11_ref.size) into caller attr_size array; sizes originate from untrusted attribute metadata.']

ルール: other

['*attr_size_ptr++ = pkcs11_ref.size;']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:145

フェーズ: ['unknown']

詳細: ['If cur > end the code calls TEE_Panic(0) indicating detection of malformed attributes; this is an abort-path rather than graceful error handling.', 'If cur > end the code calls TEE_Panic(0); this is an abort-path rather than graceful error handling and may be triggered by malformed attributes.', 'Post-loop check panics if cur > end, indicating reliance on header sizes for memory safety; malformed attrs_size can trigger TEE_Panic.', 'If cur advances past end the code TEE_Panic(0) (hard failure) is invoked; this is a defensive check but results in panic rather than graceful error handling.', 'If parsing overruns end the code calls TEE_Panic(0), which is a hard failure rather than graceful handling.', 'Advancing cur by attacker-controlled next_off can exceed end; code panics via TEE_Panic if cur > end rather than safely returning an error.', 'Advancing cur by attacker-controlled next_off can exceed end; code panics via TEE_Panic if cur > end rather than returning an error.', 'If parsing overruns end, code calls TEE_Panic which aborts execution; this is a hard failure on malformed data.', 'If parsing overruns end the code calls TEE_Panic(0) which is a hard failure on malformed data.', 'function panics if cur > end (TEE_Panic) which can be triggered by malformed pkcs11_ref.size from untrusted input', 'Function calls TEE_Panic if cur > end, which is triggered by malformed sizes from untrusted input; this is a denial-of-service risk.', 'If parsed next_off causes cur to advance beyond end, code panics (TEE_Panic), creating denial-of-service on malformed input', 'If parsed next_off causes cur to advance beyond end, code calls TEE_Panic causing denial-of-service on malformed input.', 'detects cur > end and calls TEE_Panic; malicious head->attrs_size or pkcs11_ref.size can trigger panic or OOB before this check', 'cur > end check causes TEE_Panic; malformed sizes can trigger panic or OOB before this check.', 'If parsed next_off causes cur to exceed end the code calls TEE_Panic; lack of graceful handling of malformed head is a structural risk', 'function panics if cur > end, indicating a structural risk when parsing untrusted serialized attributes', 'Function calls TEE_Panic if parsing advances past end, indicating fragile handling of malformed input.', 'if parsing overruns (cur > end) code calls TEE_Panic, indicating lack of graceful handling for malformed REE-provided data', 'If parsing overruns, function calls TEE_Panic(0) which is a denial-of-service risk when fed malformed lengths from head.', 'When parsing overruns are detected callers invoke TEE_Panic after detecting cur > end which is a denial-of-service path if memmove reads malformed lengths.', 'On parse overrun the code calls TEE_Panic(0), which is a denial-of-service risk when fed malformed lengths from head.', 'If pkcs11_ref.size is crafted large, next_off may advance cur past end triggering TEE_Panic; this is a structural risk from untrusted length fields', 'If next_off pushes cur past end the function calls TEE_Panic; parsing of untrusted lengths is a structural risk.', 'Panics if parsing advances past end (cur > end); malformed or crafted pkcs11_ref.size can trigger panic (availability risk)', 'Computes next_off from untrusted pkcs11_ref.size and advances cur by next_off; if next_off causes cur > end the code panics (TEE_Panic), indicating insufficient validation']

ルール: other, weak_input_validation

['if (cur > end) { DMSG("Exceeding serial object length"); TEE_Panic(0); }', 'next_off = sizeof(pkcs11_ref) + pkcs11_ref.size; ... if (cur > end) { TEE_Panic(0); }']

関数: ['unknown', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:150

フェーズ: ['unknown']

詳細: ['Function returns pointers/size values (attr_ptr/attr_size) that alias into attribute storage derived from REE data; downstream copies use these values for memmoves and must be bounds-checked.', 'Updates caller-provided count with number of matches found; caller logic depends on this count for further decisions']

ルール: other

['get_attribute_ptrs populates attr and attr_size arrays with pointers/sizes into serialized attributes.', '*count = found;']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:156

フェーズ: ['unknown']

詳細: ["Binding callee 'head' to caller-provided object attributes; attributes are TA-managed metadata (treated as TEE-private).", "Binding callee 'attr_ptr' to caller pointer; attr_ptr is set to point into attribute storage (TEE-private) and later used by callers.", "Binding callee 'attr_size' to caller pointer; attr_size is updated with attribute size and used for bounds checks by callers.", "Call-site binding: 'head' parameter aliases callers' object attributes (origin TEE-private object state).", "Call-site binding: 'attr_ptr' is an out-parameter that will receive a pointer into attribute storage; caller supplied pointer origin varies (caller stack or variable).", "Call-site binding: 'attr_size' is caller-provided size pointer used to return attribute size; its value influences downstream buffer checks."]

ルール: other

['get_attribute_ptrs(head, attribute, attr_ptr, attr_size, &count);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:160

フェーズ: ['unknown']

詳細: ['Relies on get_attribute_ptrs to validate attribute existence and pointer integrity; only checks count and rc but does not further validate attr_ptr contents or size semantics', 'Function trusts get_attribute_ptrs to produce a single valid pointer/count and uses count checks to decide; malformed attr lists may bypass expectations.', 'Returns NOT_FOUND when count==0 and GENERAL_ERROR when count!=1; callers depend on these semantics for control flow', 'Relies on count returned by helper; if helper returns unexpected sizes or multiple entries, function returns GENERAL_ERROR but does not sanitize pointer contents further.']

ルール: weak_input_validation, other

['if (!count) return PKCS11_RV_NOT_FOUND; if (count != 1) return PKCS11_CKR_GENERAL_ERROR;']

関数: ['=', 'unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:180

フェーズ: ['unknown']

詳細: ["Binding callee 'attr_size' to caller pointer (e.g., &size in callers); used for bounds check and updated on return.", "Call-site binding: callee parameter 'attr_size' is caller stack (&size) used for bounds check and updated by callee.", "Call-site binding: callee 'attr_size' parameter aliases caller local &size; used for bounds check and updated on buffer-too-small return.", 'Call-site binding: attr_size pointer aliases caller-provided size (e.g., &size in caller); used to check and report required size back to caller.', "Call-site binding: 'attr_size' parameter points to caller's size variable (used for buffer sizing information)", "Relies on get_attribute_ptr to provide correct size; only checks caller's provided attr_size against size but does not validate attr_ptr provenance/format.", "Binding: 'attr_size' is caller-provided length pointer; it is read and may be updated with required size causing control flow (BUFFER_TOO_SMALL path).", "Length 'size' returned by get_attribute_ptr is used to control the copy; its provenance affects safety of the move."]

ルール: other, weak_input_validation

['if (attr_size && *attr_size < size) { *attr_size = size; return PKCS11_CKR_BUFFER_TOO_SMALL; }', 'rc = get_attribute(head, attribute, &bbool, &size);']

関数: ['TEE_MemMove', '=', 'unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:186

フェーズ: ['unknown']

詳細: ["Copies 'size' bytes from attr_ptr into caller buffer 'attr' via TEE_MemMove; attr_ptr provenance depends on get_attribute_ptr and size-driven copy could overwrite if callers misreport attr_size (handled above).", "TEE_MemMove copies 'size' bytes from attr_ptr into attr; relies on earlier attr_size check when attr_size provided.", 'Copies attribute bytes from attr_ptr into caller buffer via TEE_MemMove; safety relies on prior attr_size check which is conditional (attr_size may be NULL).', "Copies 'size' bytes from attr_ptr into caller buffer via TEE_MemMove after a size check; if attr_ptr refers to untrusted/shared memory or size is attacker-influenced, this may expose data or cause overflow if checks bypassed.", 'Internal copy: TEE_MemMove(attr, attr_ptr, size) moves attribute bytes from stored attribute pointer into caller buffer.', "Binding callee 'attr' to caller buffer (e.g., &bbool in callers); attr is written via TEE_MemMove from attr_ptr.", "TEE_MemMove copies attribute data from attr_ptr (object storage) into caller buffer 'attr'; attr_ptr is TEE-side attribute storage, attr may be TA-local or caller-provided buffer.", "TEE_MemMove copies 'size' bytes from attr_ptr into attr when attr is non-null; attr_ptr provenance not strongly validated here beyond get_attribute_ptr's rc", 'Copies attribute value from attr_ptr into caller buffer attr (e.g., &bbool); attr_ptr provenance comes from get_attribute_ptrs and may point to TA or earlier REE-derived memory', 'Copies attribute value from attr_ptr into caller buffer attr; attr_ptr provenance stems from parsed data and depends on get_attribute_ptrs correctness.', "TEE_MemMove copies 'size' bytes from attr_ptr into attr; if attr points to caller-controlled shared memory, this performs a write into caller region (bounds checked via attr_size).", "TEE_MemMove copies 'size' bytes from attr_ptr into attr; size originates from get_attribute_ptr (caller-derived data) and could be attacker-influenced if attr_ptr points into REE-origin data", "Call-site binding: callee parameter 'attr' is caller stack (&bbool) passed to be written by get_attribute (TA-local buffer).", 'Copies from attr_ptr (origin determined by get_attribute_ptr) into provided buffer; attr_ptr origin and size must be trusted/validated upstream.', "Copies attribute data from attr_ptr into caller-provided buffer 'attr' via TEE_MemMove; if callers pass a REE-visible buffer elsewhere, this is a TA->REE copy vector.", "TEE_MemMove copies attribute bytes from attr_ptr (derived from object attrs) into caller buffer 'attr'; attr_ptr content origin may be TA-private object data.", 'Relies on get_attribute_ptr to return correct size and pointer; if get_attribute_ptr is influenced, callers may receive unexpected attribute data.', 'copies size bytes from attr_ptr into attr via TEE_MemMove where size is derived from get_attribute_ptr; limited bounds check only compares caller-provided *attr_size and may not validate attr_ptr provenance', 'Copies attribute payload into caller buffer where size originates from attribute metadata; insufficient provenance checks may allow buffer-too-small conditions upstream.', "Copies 'size' bytes from attr_ptr into caller buffer attr; size originates from stored attribute metadata and attr pointer provenance may be untrusted if caller passed REE-visible buffer", 'copies size bytes from attr_ptr into caller buffer attr via TEE_MemMove relying on get_attribute_ptr-provided size without revalidating attr_ptr or that size matches caller buffer', 'Copies size bytes from attr_ptr into caller buffer attr after size determined by metadata from get_attribute_ptr; attr_ptr provenance may be untrusted and size validation relies on attr_size check only', "TEE_MemMove copies 'size' bytes from attr_ptr into attr relying on prior attr_size check; if attr_size is NULL or attr not large enough this can cause overflow", "Call-site binding: 'attr' (destination) at this call is &bbool from caller (TA-local buffer)", 'Copies size bytes from attr_ptr into attr without validating attr_ptr provenance or ensuring size is bounded by caller buffers beyond attr_size check', 'copies size bytes from attr_ptr (derived from head, possibly REE-supplied) into attr without additional validation of attr_ptr provenance; relies on earlier size check which may be manipulated', "Copies attribute payload of size 'size' derived from head into caller buffer; relies on prior size checks.", "Copies attribute bytes from attr_ptr (sourced from head via get_attribute_ptr) into caller buffer 'attr'; attr_ptr may originate from REE-parsed data.", "Copies attribute bytes from attr_ptr (may point into REE-origin parsed buffer) into caller buffer 'attr'.", 'Copies attribute bytes from attr_ptr into caller buffer attr via TEE_MemMove; if attr points to REE-visible memory this writes into shared memory', "Binding: 'attr' is destination pointer supplied by caller (often &boolval or &key_length) and will receive size bytes from attr_ptr via TEE_MemMove.", "Copies attribute payload from attr_ptr into caller buffer 'attr' using size from attr metadata; correctness depends on get_attribute_ptr's validation of attr_ptr/size", 'Copies attribute payload from attr_ptr to attr via TEE_MemMove; relies on prior size check to avoid overflow.', "TEE_MemMove copies 'size' bytes from attr_ptr into attr; size originates from get_attribute_ptr and attr_ptr region is not validated, so upstream input validation is weak.", 'General copy site where size is derived from get_attribute_ptr; callers must supply correct attr_size to avoid buffer issues.', "Copies 'size' bytes from attr_ptr into caller buffer; size is derived from metadata and relies on get_attribute_ptr correctness.", "TEE_MemMove performs raw memory copy using caller-provided size 'size' without validating attr_ptr provenance or ensuring dest buffer capacity here.", 'Generic memory copy can write into REE-visible buffers if callers pass shared memrefs as dest; potential shared-memory overwrite depending on caller context', 'Copies attribute bytes from attr_ptr into caller buffer attr via TEE_MemMove; if caller supplies a REE-visible destination this writes into shared memory.', 'Generic memory copy can write into REE-visible buffers if callers pass shared memrefs as dest; potential shared-memory overwrite depending on caller context.']

ルール: other, weak_input_validation

['if (attr)\n    TEE_MemMove(attr, attr_ptr, size);', 'if (attr) TEE_MemMove(attr, attr_ptr, size);', 'TEE_MemMove(attr, attr_ptr, size);', 'rc = get_attribute(head, attribute, &bbool, &size);', 'rc = get_attribute_ptr(head, attribute, &attr_ptr, &size);']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:187

フェーズ: ['unknown']

詳細: ["Binding: attr buffer (dst) is written from attr_ptr (src) with size 'size'; attr/attr_ptr provenance comes from caller-managed structures", 'Copies attribute value from attr_ptr into attr buffer; attr_ptr provenance may be REE-derived', 'Copies attribute value into attr buffer from attr_ptr; binding shows src may originate from obj blob and dst may be TA-managed buffer.', 'Copies attribute value into provided attr buffer from attr_ptr; origin and size of attr_ptr may be TA or REE-controlled (uncertain)', 'copies attribute data from attr_ptr into attr buffer using size parameter; origin and bounds of attr/attr_ptr depend on upstream parsing', "Binding: 'attr' destination pointer provided by caller (TA-private target for attribute data)", "Copies 'size' bytes from attr_ptr (which may point into parsed/unchecked input) into attr without validating bounds", 'Copies attribute bytes from attr_ptr (possibly REE-derived) into attr buffer pointer provided by caller; bind src provenance', "Copies attribute bytes from internal attr_ptr into caller buffer 'attr' using size determined by attribute metadata; attr is caller-provided and must be trusted for capacity checks performed earlier.", 'Copies attribute bytes from internal attr_ptr into caller buffer using size determined by metadata; relies on earlier size checks.', "Copies attribute payload pointed by attr_ptr into caller-provided buffer 'attr'; relies on prior attr_size check to avoid overflow.", "Copies attribute payload from attr_ptr (may point into serialized/REE-controlled area) into caller buffer 'attr'; safety relies on prior attr_size checks at caller.", 'Copies attribute payload into caller buffer; relies on caller-provided attr_size checks to avoid overflow.', 'Copies attribute value from attr_ptr (pointer into serialized region) into caller buffer attr; attr_size is used as bound and may be influenced by serialized data', "Copies attribute payload from attr_ptr (pointer returned by get_attribute_ptrs) into caller buffer 'attr'; attr_ptr may alias TA storage that was populated from REE-origin data", "Copies attribute bytes from attr_ptr into caller-provided buffer 'attr' via TEE_MemMove; destination origin may be REE-visible leading to shared-write risk.", 'Copies attribute bytes from attr_ptr into caller-provided buffer via TEE_MemMove; destination may be caller-controlled REE-visible buffer leading to possible info disclosure later.', "Caller-provided buffer 'attr' (could be caller stack or caller-supplied) is written from attr_ptr via TEE_MemMove; origin of attr in callers varies.", "Copies attribute data from attr_ptr (object storage) into caller buffer 'attr'; destination is caller-provided and may vary (TA-local or caller-managed), affecting exposure.", 'Copies attribute data from attribute storage into caller buffer; downstream exposures possible if attributes contain sensitive values and are later copied to REE.', "TEE_MemMove copies attribute data from attr_ptr into caller-supplied buffer 'attr'; destination size is checked earlier but copy uses 'size' determined by get_attribute_ptr", "Copies attribute payload from attr_ptr (inside serialized object) into caller-supplied buffer 'attr'; attr and attr_size were previously checked for size but copy length is derived from parsed size.", "Copies 'size' bytes from attr_ptr into caller buffer 'attr'; destination may be caller stack or shared memory depending on caller.", "Copies 'size' bytes from attr_ptr into caller-provided attr; size originates from get_attribute_ptr and may reflect unvalidated data-derived size.", "Copies 'size' bytes from attr_ptr into attr; size comes from get_attribute_ptr (which may be derived from unvalidated serialized data).", "Call-site binding: dest 'attr' may be caller buffer (could be TA-local or caller-provided) receiving attribute bytes from attr_ptr (pointer into TA-private storage).", "Copies attribute value from attr_ptr (internal attribute storage) into caller-supplied buffer 'attr' (TA-local buffer in this call-site); relies on prior size checks but src length drives copy.", "Copies attribute payload into caller-provided buffer 'attr' using size from attribute metadata; destination is caller memory and size originates from attribute list", 'Copies attribute payload into caller buffer using size from attribute metadata; relies on prior parsing correctness', "Copies attribute payload into caller-provided buffer 'attr' from attr_ptr; origin of attr_ptr may be REE-derived and destination region depends on caller.", "Copies attribute bytes from attr_ptr (object storage) into caller buffer 'attr'; attr may be caller-provided and thus the copy can expose TA-held data if attr is REE-visible.", 'Copies attribute bytes from object storage into caller buffer; if caller buffer is REE-visible this can disclose TA-held data.', 'Copies attribute bytes from attr_ptr (points into head) into caller buffer; size is derived from attr metadata and may be larger than caller buffer if not validated by caller.', "Copies attribute payload from attr_ptr into caller buffer 'attr' using size from metadata; caller previously relied on get_attribute_ptr for size", "Copies 'size' bytes from attr_ptr (pointer into attribute storage) into caller buffer attr; relies on upstream attr_size checks to be correct", "Copies 'size' bytes from attr_ptr (pointer derived from head contents) into caller buffer attr; size originates from metadata and may be untrusted", 'Copies attribute payload into caller buffer using size from metadata without validating attr_ptr provenance and remaining buffer.', "Copies 'size' bytes from attr_ptr (found by parsing possibly REE-origin data) into caller buffer attr; relies on prior attr_size checks but attr may be NULL or attr_size absent leading to misuse", 'Copies attribute payload from attr_ptr into caller-supplied attr buffer; provenance of attr_ptr depends on head/candidate (could be shared), size comes from attribute metadata', 'copies size bytes from attr_ptr (derived from parsed head content) into caller buffer attr; relies on earlier size checks which may be manipulated and attr_ptr provenance is from head', 'Copies attribute bytes from attr_ptr (may point into untrusted-derived region) into attr buffer without extra validation beyond size checks performed by callers.', "Copies attribute bytes from attr_ptr (which may point into REE-origin parsed buffer) into caller buffer 'attr'", 'Copies attribute data from attr_ptr into caller buffer attr; if attr points to REE-visible memory this writes into shared memory', "Copies attribute payload from attr_ptr (TA-resident pointer into template) into caller buffer 'attr' (often TA-local); size driven by attr_ptr-derived size.", 'Copies attribute payload from attr_ptr into caller-provided buffer attr; caller previously checked sizes but attr_ptr provenance depends on earlier lookup', 'Copies attribute payload into caller buffer after a size check, but attr_ptr provenance depends on earlier parsing; potential issues if earlier parsing was inconsistent.', "Copies attribute payload from attr_ptr into caller buffer 'attr' using size from metadata; correctness depends on attr_ptr/size validated upstream", "Destination 'attr' is caller-provided buffer (may be TA-private or point into template); callee writes attribute payload into it.", "Source 'attr_ptr' is pointer into attribute storage (from get_attribute_ptrs); callee reads from TA-side storage.", "Copies attribute value pointers/data into caller-supplied buffer 'attr' using size from attribute metadata; destination/capacity not validated here.", 'Copies attribute pointer(s) into caller-provided attr array (out-parameter); creates aliases to locations inside head', 'Copies attr_ptr array into caller-supplied attr buffer using size from caller; binding writes pointers into caller memory (alias of &req_attrs in caller).', 'Copies attribute pointers into caller-supplied buffer using size from caller; improper sizes could overwrite caller memory.', 'Copies attribute bytes to caller-provided attr pointer; attr (destination) origin may be REE or TA depending on caller, so alias binding is uncertain', 'Copies attribute value to caller-provided buffer; destination origin may be TA or REE and size is derived from parsed data.', "Copies attribute value into caller-supplied 'attr' pointer; destination origin depends on caller (may be REE-visible) — binding of callee param to caller-provided buffer", "Call-site binding: destination 'attr' (caller buffer) may be populated from attr_ptr data; origins depend on caller (populated pointers into head).", 'Copies attribute pointers/content from attr_ptr into caller-provided attr destination; origin of attr_ptr may be derived from parsed buffers', 'Copies attribute payload pointers/bytes from attr_ptr into attr buffer provided by caller; attr_ptr may alias into REE-derived buffers', 'Writes into attr (caller-provided output pointer) data from attr_ptr (derived from parsed object), binding caller outputs to parsed buffer', 'Copies attribute value pointer data from attr_ptr into attr buffer using size from caller; source/size may be attacker-controlled.', 'Copies attribute data to attr (output array) from attr_ptr; binding of potential TA/REE sources into attr destination', "Copies 'size' bytes from attr_ptr into caller buffer 'attr' via TEE_MemMove; if pointers or size are tainted/misreported this can overwrite destination.", "Call-site binding: destination 'attr' aliases caller buffer (&bbool) provided by get_attribute caller.", "Call-site binding: source 'attr_ptr' originates from get_attribute_ptr and is used as copy source.", "Copies attribute bytes from attr_ptr into caller stack buffer 'attr' (both TA-private); size determined by 'size'.", "Binding of destination pointer 'attr' (caller buffer) into TEE_MemMove; origin is caller-local (&bbool) in this call-site and considered TEE-private.", "Binding of source pointer 'attr_ptr' (attribute storage) into TEE_MemMove; origin from get_attribute_ptr may be TA-managed or derived from REE-parsed data (ambiguous).", "Copy operation relies on prior conditional attr_size check; if attr_size is NULL caller-safety isn't enforced here (attr assumed non-NULL).", "destination pointer 'attr' is caller-provided buffer used as TEE_MemMove destination; may be smaller than 'size' unless caller-checked", "source pointer 'attr_ptr' originates from get_attribute_ptr and is copied into caller buffer; source provenance may be caller-influenced templates", "length parameter 'size' controls the copy and originates from get_attribute_ptr; if attacker-influenced, may cause over-read/over-write if caller's attr_size not properly checked", "Call-site binding: destination 'attr' aliases caller-local buffer (&bbool) which is TA-private; record binding of dst to TA-private.", "Destination 'attr' is a caller-local TA buffer (&bbool) receiving data via TEE_MemMove; dest is TA-private but may receive REE-influenced content", "Source 'attr_ptr' may alias object attribute storage that was derived from REE-provided templates; provenance REE->TA (attr content REE-influenced)", "Length 'size' is used to control the copy; although checked earlier, its provenance may be influenced by attribute metadata", "Dest parameter 'attr' aliases caller stack buffer (&bbool) which receives bytes from stored attribute; origin is TA stack (TEE-private).", "Src parameter 'attr_ptr' is pointer into stored attribute data (TA-owned), treated as TEE-private source for copy.", "Size parameter 'size' originates from attribute metadata and is used to control the copy; if incorrect it can cause overflow of dest.", "Copies attribute bytes from attr_ptr into caller-provided buffer 'attr' via TEE_MemMove; destination origin (caller buffer) can be TA-private or caller-controlled (ambiguous).", 'Copies attribute bytes into caller buffer; destination origin can be TA-private or caller-controlled and attr_ptr provenance is ambiguous.', "Destination 'attr' is a caller-provided buffer (e.g., &bbool) bound into this helper and written via TEE_MemMove.", "Copies attribute data from attr_ptr (TEE-private object storage) into caller buffer 'attr'; if caller buffer aliases REE-visible memory this can expose TA data.", "Binding: destination pointer 'attr' at call-site may be a caller-provided buffer (e.g., &bbool or REE-origin); record origin as TEE-private for local buffers or REE-visible when caller supplies shared mem.", "Binding: source pointer 'attr_ptr' originates from get_attribute_ptr (object attribute storage) and is treated as TEE-private.", "alias of destination 'attr' bound to caller buffer (stack-local bbool in get_bool); copies from attr_ptr into caller buffer", "TEE_MemMove performs a raw memory copy from attr_ptr to attr; caller-side size check exists but copy uses 'size' returned by get_attribute_ptr which must be trusted", "Destination 'attr' is caller stack memory (TEE-private) while source 'attr_ptr' provenance is from get_attribute_ptr and may be unknown/shared; alias/binding of pointers at call-site", "Copies 'size' bytes from src to dst without in-function validation of src/dst regions or that dst has at least 'size' bytes (relies on caller); if caller-supplied sizes are tainted this is risky", "Call-site binding: destination 'attr' (&bbool) is caller memory (TA stack) and will be written by TEE_MemMove.", "Call-site binding: source 'attr_ptr' originates from get_attribute_ptr (attribute storage) and is read as src for the move.", 'alias of caller-provided destination buffer (attr) passed into TEE_MemMove; destination originates from caller-local &bbool in get_bool', 'alias of source pointer (attr_ptr) passed into TEE_MemMove; attr_ptr originates from get_attribute_ptr and its region could be TA-private or REE-visible (unknown)', "copies 'size' bytes from attr_ptr into attr without validating that attr_ptr points to trusted memory region; size originates from get_attribute_ptr and may be influenced by input", "Call-site binding: dest 'attr' is caller stack (&bbool) (TA-private) written by TEE_MemMove.", "Call-site binding: src 'attr_ptr' originates from get_attribute_ptr (obj attributes, TA-private).", "destination 'attr' is a caller-local buffer; TEE_MemMove will write up to 'size' bytes into it based on attr_ptr-derived size", "source 'attr_ptr' derives from get_attribute_ptr(head, ...); provenance of attr_ptr depends on head (caller-controlled), may be TA-private or unknown", "TEE_MemMove copies up to 'size' bytes from attr_ptr into caller buffer 'attr'; although bounds-checked, attr_ptr provenance depends on head which may be derived from REE-parsed template.", 'Copies size bytes from attr_ptr (TA-private attribute storage) into attr (caller stack buffer) — dest and src are TA-private but size is caller-controlled.', "Binding of destination pointer 'attr' (caller buffer &bbool) into memmove; destination origin is caller stack (TA-private) but caller-provided size may be smaller.", "Binding of source pointer 'attr_ptr' into memmove; origin determined by get_attribute_ptr and may be REE-derived or TA-owned (ambiguous).", "Copies 'size' bytes without additional runtime sanitizer here; relies on caller to have validated attr_size vs size.", 'Copies attribute bytes from attr_ptr into caller buffer attr; source may originate from object attributes derived from REE-provided templates', "Call-site binding: destination 'attr' is caller-provided buffer (here &bbool) — region is TEE-private stack at this call-site.", "Call-site binding: source 'attr_ptr' originates from get_attribute_ptr and may reference data derived from REE input (processed into TA memory) — record as unknown/TEE-private origin.", "Performs raw memory copy of 'size' bytes; if destination in other call-sites is REE-visible, this becomes TA->REE copy and may expose TA-held data.", "Raw memory copy of 'size' bytes; when callers pass REE-visible buffers this becomes a TA->REE copy and may expose TA data.", "Call-site binding: dest 'attr' is caller buffer (e.g., &bbool in get_bool) and src 'attr_ptr' is attribute storage pointer; copies size bytes from attr_ptr into attr.", 'Copies size bytes from attr_ptr into attr; size originates from get_attribute_ptr and may reflect untrusted/unknown provenance without stronger validation of attr_ptr', 'Call-site binding: dst (&bbool) is caller-local TA buffer, src (attr_ptr) originates from attribute storage (TA-private) returned by get_attribute_ptr', "copies 'size' bytes from attr_ptr (origin from get_attribute_ptr) into caller buffer attr relying on size without revalidating attr_ptr provenance", "Dest is caller stack buffer (&bbool, TA-local) while src attr_ptr provenance comes from get_attribute_ptr (may be REE-influenced); copy length 'size' derived from metadata", "Copies 'size' bytes from attr_ptr (obtained from get_attribute_ptr, potentially REE-derived) into caller buffer 'attr' relying on earlier check; if attr_size was NULL or check bypassed, destination may be undersized.", "Call-site binding: destination 'attr' is caller-owned buffer (&bbool) in TA stack/local", "Copies 'size' bytes from attr_ptr (origin resolved by get_attribute_ptr) into dest; src provenance and size bounds rely on upstream checks", "copies 'size' bytes from attr_ptr (derived from head, possibly REE-supplied) into caller buffer attr; size originates from get_attribute_ptr and may be attacker-controlled", "Performs raw copy from src to dest using size 'size' without validating provenance of src/size beyond upstream checks; if src or size are attacker-controlled this can copy unexpected data or overflow caller buffers.", "Call-site binding: destination 'attr' aliases caller stack buffer (&bbool) which is TA-private.", "Call-site binding: source 'attr_ptr' may point into data derived from 'head' (which can be REE-originated), so src region is unknown/possibly REE-visible.", "Copies attribute bytes from attr_ptr (sourced from parsed attributes) into caller buffer 'attr'; source likely originates from REE-parsed data.", 'attr (caller buffer) is destination for copy from attr_ptr which was obtained from head derived from REE templates; alias binds caller dest to origin', "Destination 'attr' is caller-supplied buffer (often TA-local like &boolval) receiving bytes from attr_ptr which may originate from object attributes; alias/binding recorded.", 'copies size bytes from attr_ptr (TA-internal) into caller-supplied attr buffer; binding dest to caller-local buffer', "copies 'size' bytes into attr without guaranteed destination bounds when attr_size is NULL or mismatched", "Copies attribute payload from attr_ptr (TA-private attribute storage) into caller buffer 'attr' (TA-local); correctness depends on get_attribute_ptr validation", "Call-site binding: dst 'attr' (caller buffer) receives data from attr_ptr within template; both are TEE-private buffers."]

ルール: other, weak_input_validation

['TEE_MemMove(attr, attr_ptr, size);', 'if (attr) TEE_MemMove(attr, attr_ptr, size);', 'if (attr)\n\tTEE_MemMove(attr, attr_ptr, size);', 'call-site: rc = get_attribute(head, attribute, &bbool, &size); -> TEE_MemMove(attr, attr_ptr, size)', 'attr_ptr obtained via get_attribute_ptr(...) then used in TEE_MemMove']

関数: ['TEE_MemMove', '=', 'unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:220

フェーズ: ['unknown']

詳細: ['Reads client-provided attribute header into local cli_head via memmove; source may be REE-visible', 'parses lengths from head->attrs_size and cli_head.size to bound loop and compute len without strong validation of attrs_size/cli_head.size', 'copies cli_head from cur and then uses cli_head.size to compute len; size derived from memory without extra validation', 'Parses cli_head from cur and uses cli_head.size to compute len without strong validation of cli_head.size relative to remaining buffer.', 'Copies header from cur via TEE_MemMove without verifying remaining bytes; header.size influences subsequent parsing', 'Copies cli_head from cur without explicit remaining-bytes check; cli_head.size then used to advance and parse entries.', 'Copies cli_head from cur for parsing; subsequent len uses cli_head.size to advance parsing pointer.', 'Copies client-supplied serialized attribute header into cli_head; source comes from cur computed from head and can affect next length computations', "Copies cli_head from 'cur' into local structure; source is parsed serialized data so origin may be untrusted.", 'Copies cli_head from cur then uses cli_head.size to compute len without validating cli_head.size bounds', 'Copies cli_head from cur and then uses cli_head.size to compute len without additional validation; malformed size could affect subsequent reads.', 'Copies cli_head from cur into local header; subsequent use of cli_head.size influences loop offsets and pointer arithmetic based on possibly untrusted data.', 'Copies cli_head from cur (parsed bytes) into local structure and then uses cli_head.size to compute len without explicit validation against remaining buffer', 'Reads cli_head header from cur (head buffer) into local cli_head using sizeof(cli_head) without revalidating remaining bytes', 'Copies cli_head header from cur (from head buffer) into local struct and then uses cli_head.size to advance/size entries without validating bounds', 'Copies cli_head from cur (parsed from head) into local structure using sizeof without explicit remaining-bytes check beyond loop bounds', "Copies cli_head from 'cur' (untrusted) into local cli_head and then uses cli_head.size for length calculations without explicit validation", 'Copies cli_head from cur and then uses cli_head.size to compute len; trusting unvalidated size field from blob can lead to out-of-bounds', 'Copies client-supplied attribute header from template into local cli_head; source may be REE-derived template memory.', 'Copies cli_head from cur and uses cli_head.size to set len without validating remaining bytes', 'Destination &cli_head is local stack; memmove writes parsed header into local struct.', "Source 'cur' reads from template buffer; parsed size influences subsequent logic.", 'Copies cli_head from cur into local struct without explicit check that remaining bytes >= header size.', 'Reads cli_head from cur (refers to serialized client data) without per-entry pre-checks; cli_head.size used to advance len.', 'Copies client-supplied attribute header from ref location into local cli_head; used length cli_head.size influences subsequent parsing', 'Copies client-provided attribute header bytes into local cli_head from cur; src is parsed buffer and could be attacker-controlled', 'Copies attribute header from cur into local cli_head; cur originates from serialized buffer possibly from REE', 'Copies client-provided header from cur into cli_head on stack; cur may be from shared buffer', "Copies bytes from 'cur' into local cli_head; 'cur' likely references serialized input region (unknown), destination is stack-local.", "Call-site binding: destination &cli_head is a stack-allocated struct receiving data from 'cur' (serialised input) which may originate from REE; dst is TA-private.", "Copies serial header bytes from 'cur' into local cli_head via TEE_MemMove; source 'cur' may be REE-originated serialized input (shared).", 'Copies serial header from potentially REE-originated buffer into local cli_head; serialized input provenance may be untrusted.', "alias of destination '&cli_head' bound to local struct on stack; copies from 'cur' (serial buffer) into local header", "Copies header from serial buffer 'cur' (likely REE-originated) into TA stack-local cli_head; caller ensures len calculations but serial buffer provenance is REE-visible.", "Call-site copies a header from serialized input ('cur') into a local struct; source 'cur' originates from serial buffer (REE-visible) and is aliased into local TEE memory", 'Copies serialized header from cur (likely serialized REE/TA source) into local cli_head; origin of cur may be shared or internal depending on parsing path.', 'Copies serialized header bytes from cur (possibly REE-provided serial buffer) into local cli_head via fixed-size memcpy', "Call-site binding: dest '&cli_head' is local stack, src 'cur' is buffer parsed from serialized input (caller-controlled); copies fixed sizeof(cli_head).", 'Copies sizeof(cli_head) from cur into stack cli_head where cur is derived from head (which may be REE-supplied); relies on surrounding loop bounds to be correct', 'Copies attribute header from cur (derived from head which may be REE-supplied) relying on loop bounds; insufficient per-item validation of cli_ref.size before using it to advance len.', 'Copies sizeof(cli_head) from cur which is derived from head buffer (client-supplied); cli_head.size later used without separate validation here', 'reads header from cur into cli_head using sizeof(cli_head) where cur is derived from head (which may be REE-supplied); size field subsequently used to advance loop', "Copies header from 'cur' (parsed from head buffer) into local cli_head using fixed sizeof(cli_head) without validating remaining bytes against cli_head.size first", 'Copies sizeof(cli_head) bytes from cur (derived from head, which may be REE-supplied) into local cli_head without additional per-field validation beyond loop bounds.', "Call-site binding: destination '&cli_head' is local stack structure receiving bytes from 'cur' (parsed input)", 'copies attribute header from cur (within head derived from REE) into local cli_head and uses returned cli_head.size to advance parsing without extra validation', "Parses client attribute header by copying from serial buffer 'cur' into local cli_head; 'cur' originates from REE-provided serial data.", 'Copies serialized attribute header from cur into local cli_head; dest is local stack, src is parsed buffer', "Copies from 'cur' (pointer into template buffer allocated from serial args which is derived from REE data) into local cli_head; source may contain REE-derived content.", 'Copies attribute header from template (which may be derived from REE-serialized data) into local cli_head; template provenance includes REE-provided serial buffer.', 'copies sizeof(cli_head) from cur (derived from head which may be REE-supplied) into local cli_head', 'Reads cli_head from cur which points into parsed attribute buffer (originates from caller-supplied head/template)', "Call-site binding: copies into local cli_head from 'cur' (template region) on stack; source is template memory.", 'destination &cli_head is a local/TEE-private buffer receiving data from cur (region derived from head); binding of dst to caller origin', 'copy from cur uses sizeof(cli_head) while loop bounds use head->attrs_size; cli_head.size then used to compute len without stronger validation', 'parses cli_head.size from unvalidated buffer and uses it to compute len and advance cur without ensuring sufficient remaining bytes for each copy.', "Copies header from potentially REE-influenced buffer 'cur' into TA stack cli_head; length used without verifying remaining bytes at call-site", 'cli_head.size (from REE-derived template) is used to compute len and drive the loop without strict upper bounds validation', 'Copies header from parsed stream without verifying remaining bytes; header.size then used to drive parsing.']

ルール: other, weak_input_validation

['TEE_MemMove(&cli_head, cur, sizeof(cli_head));', 'TEE_MemMove(&cli_head, cur, sizeof(cli_head)); len = sizeof(cli_head) + cli_head.size;']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:221

フェーズ: ['unknown']

詳細: ['Uses cli_head.size (from unvalidated header) to compute len and advance loop, enabling OOB or infinite loop if header is malicious', 'Uses cli_head.size to compute len and advance loop, enabling mis-parsing or OOB if header is malicious.', 'Uses cli_head.size (from unvalidated header) to compute len and advance loop, enabling OOB or infinite loop if header is malicious.', "Uses cli_head.size (unvalidated) to compute loop advance 'len', enabling OOB or logic issues if malicious."]

ルール: weak_input_validation

['len = sizeof(cli_head) + cli_head.size;']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:235

フェーズ: ['unknown']

詳細: ['get_bool asserts rc == PKCS11_CKR_OK after get_attribute; if get_attribute returns BUFFER_TOO_SMALL the assert can trigger, causing an availability issue.']

ルール: other

['rc = get_attribute(head, attribute, &bbool, &size); if (rc == PKCS11_RV_NOT_FOUND) return false; assert(rc == PKCS11_CKR_OK);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:236

フェーズ: ['unknown']

詳細: ['get_bool asserts rc == OK after get_attribute; if attribute parsing originates from REE, relying on assert may be insufficient validation.']

ルール: weak_input_validation

['if (rc == PKCS11_RV_NOT_FOUND) return false; assert(rc == PKCS11_CKR_OK);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:241

フェーズ: ['unknown']

詳細: ['Asserts rc == OK after get_attribute; if attribute data originate from REE parsing, relying on assert may be insufficient validation.', 'get_bool asserts on unexpected rc values (other than NOT_FOUND and OK), which could lead to TA abort if callers receive BUFFER_TOO_SMALL.', 'get_bool asserts rc == PKCS11_CKR_OK after calling get_attribute; if get_attribute returns BUFFER_TOO_SMALL an assert can crash (DoS).']

ルール: weak_input_validation, other

['if (rc == PKCS11_RV_NOT_FOUND)\n    return false;\n\nassert(rc == PKCS11_CKR_OK);', 'if (rc == PKCS11_RV_NOT_FOUND) return false; assert(rc == PKCS11_CKR_OK);', 'rc = get_attribute(head, attribute, &bbool, &size);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:244

フェーズ: ['unknown']

詳細: ['get_bool uses assert(rc == PKCS11_CKR_OK) for unexpected error codes which may abort the TA instead of graceful error handling.']

ルール: weak_input_validation

['assert(rc == PKCS11_CKR_OK);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:265

フェーズ: ['unknown']

詳細: ['Copies referenced attribute header into local pkcs11_ref from ref_attr which may be in REE-managed memory', 'Copies pkcs11_ref from ref_attr (origin of ref_attr unclear); if ref_attr is attacker-controlled, header fields may be tainted.', 'Copies pkcs11_ref from ref_attr into local pkcs11_ref; ref_attr provenance may be caller-controlled serialized data.', 'Copies pkcs11_ref from ref_attr into local struct; ref_attr provenance may be internal or external depending on call-site (used for reference comparisons).', 'Copies pkcs11_ref from ref_attr (external data) into local structure and uses its size fields for subsequent checks', 'Copies pkcs11_ref header from ref_attr (reference buffer) into local pkcs11_ref; origin of ref_attr may be REE or TA-managed depending on caller', 'Copies pkcs11_ref from ref_attr into local struct; ref_attr provenance may be untrusted and size used later without full validation', 'Copies pkcs11_ref from ref_attr (reference data) into local pkcs11_ref without validating ref_attr length here', 'Copies pkcs11_ref from ref_attr (source from caller) into local header for reference checks; binds callee params to caller-origin', 'Copies serialized attribute header from ref_attr into pkcs11_ref (local); ref_attr may point into REE-origin template.', 'Copies pkcs11_ref from ref_attr (possibly REE-origin) into local structure for further processing', 'Destination &pkcs11_ref is local; writing ref header into stack from ref_attr source.', "Source 'ref_attr' is derived from caller data (possibly template/ref buffer); origin considered TEE-private here.", 'Copies pkcs11_ref from ref->attrs without an explicit overall buffer-length check against ref->attrs_count/total bytes; malformed ref could cause out-of-bounds reads.', 'Copies pkcs11_ref from ref_attr into local struct without validating that ref->attrs contains enough bytes for header.', 'Copies header from ref_attr without validating that ref buffer contains enough bytes for the header.', 'Reads attribute header from ref_attr into pkcs11_ref and then trusts pkcs11_ref.size for further operations without extra validation', 'Copies attribute header from ref_attr into local pkcs11_ref; ref_attr provenance may be attacker-controlled', 'Copies referenced attribute header from ref_attr into local pkcs11_ref; src may be REE-derived', 'Copies reference header from ref_attr into local pkcs11_ref; source origin unknown (could be serialized input).', 'Copies reference structure from ref_attr into local pkcs11_ref via TEE_MemMove; ref_attr provenance may be untrusted input.', 'Copies reference structure from ref_attr (possibly untrusted) into local pkcs11_ref.', 'Copies ref metadata from ref_attr into local pkcs11_ref; source may be untrusted serialized data', 'Copies pkcs11_ref structure from ref_attr into local pkcs11_ref; origin of ref_attr is context-dependent (unknown)', 'Copies pkcs11_ref from ref_attr (parsed data); subsequent use of pkcs11_ref.size may be attacker-controlled if not validated', 'copies fixed-size pkcs11_ref from ref_attr into local structure; both are TA-managed in this path', 'Copies referenced attribute header from ref_attr (parsed data) into local pkcs11_ref; ref_attr is from REE-origin serial buffer.', 'Copies reference attribute into pkcs11_ref from ref_attr; source originates from parsed data', 'copies sizeof(pkcs11_ref) from ref_attr into local pkcs11_ref; ref_attr provenance may be REE-derived', 'Copies pkcs11_ref from ref_attr (pointer into parsed data) into local pkcs11_ref; source likely from parsed/REE-provided buffer', 'Call-site binding: copies pkcs11_ref from ref_attr (likely from serialized template region) into local pkcs11_ref.', 'destination &pkcs11_ref is local and receives bytes from ref_attr (origin region tied to head/cur)', 'Copies reference structure from ref_attr into local pkcs11_ref; origin of ref_attr is parsed data (unknown)', 'Copies pkcs11_ref from ref_attr using sizeof(pkcs11_ref) without an explicit overall bounds check against ref->attrs total bytes; a malformed ref can cause out-of-bounds read.', "Call-site binding: destination '&pkcs11_ref' is a local TA stack object (TEE-private) receiving data from ref_attr.", "Call-site binding: source 'ref_attr' aliases ref->attrs provided by caller (origin from req_attrs); origin considered TA-private but upstream provenance varies.", 'Call-site bindings: ref_attr aliases ref->attrs provided by caller; pkcs11_ref is local TA storage receiving the copy.']

ルール: other, weak_input_validation

['TEE_MemMove(&pkcs11_ref, ref_attr, sizeof(pkcs11_ref));']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:298

フェーズ: ['unknown']

詳細: ['Copies pkcs11_ref from ref_attr (caller-supplied reference); subsequent get_attribute_ptr uses pkcs11_ref.id/size influencing control flow.', 'Copies pkcs11_ref from ref_attr (possibly REE-originated serialized ref) into local header; ref_attr size influences subsequent attribute lookups', 'Copies pkcs11_ref from ref_attr into local structure before using id/size to fetch attributes; malformed input can influence control flow.', 'Copies pkcs11_ref from ref_attr prior to querying attribute pointer; the ref structure guides subsequent attribute lookup and may be attacker-influenced.', 'Copies pkcs11_ref from ref_attr then uses pkcs11_ref.id/size to look up attributes; ref_attr provenance may be untrusted', 'Copies pkcs11_ref from ref_attr into local struct before using its id/size; ref_attr provenance varies by caller', 'Copies pkcs11_ref from ref_attr into local struct before using pkcs11_ref.id/size for lookups; ref_attr may be attacker-controlled', 'Copies pkcs11_ref from ref_attr into local pkcs11_ref before using id/size to fetch attribute pointers; ref_attr provenance may be untrusted', 'Copies pkcs11_ref from ref_attr into local struct before using its id/size to lookup attributes; source may be attacker-controlled', 'Copies referenced attribute header from ref_attr into local pkcs11_ref prior to lookup; source origin may be untrusted serialized data.', 'Copies pkcs11_ref header from ref_attr before using its id to query attributes; relies on integrity of ref_attr contents', 'Destination &pkcs11_ref is local; callee writes header from ref_attr.', "Source 'ref_attr' originates from caller context; treated as TEE-private here.", 'Copies header from ref_attr into pkcs11_ref and then uses its id/size for a lookup without validating ref_attr provenance', 'Copies attribute header from ref_attr into local pkcs11_ref before further parsing; source region uncertain', 'Copies referenced attribute header into local pkcs11_ref before resolving value; source may be untrusted', 'Copies reference header into local pkcs11_ref; source is ref_attr (unknown origin).', 'Copies ref metadata from ref_attr into local pkcs11_ref at alternate codepath; source provenance may be REE-visible', 'copies fixed-size pkcs11_ref from ref_attr into local structure before lookup; origin likely TA-private', 'Copies referenced attribute header from ref_attr into pkcs11_ref for subsequent get_attribute_ptr; source likely REE-origin.', 'Copies reference attribute into pkcs11_ref from ref_attr (similar parsing path)', 'copies sizeof(pkcs11_ref) from ref_attr into pkcs11_ref at another call site; binding shows ref_attr origin', 'Copies pkcs11_ref from ref_attr into local structure before using it to index attributes; relies on validity of ref_attr/size', 'Call-site binding: similar copy of pkcs11_ref from ref_attr into local; used to lookup attribute pointer next.', 'destination &pkcs11_ref is local and source ref_attr derives from parsed head data', 'Copies reference structure from ref_attr into local pkcs11_ref at another call-site; source provenance unclear']

ルール: other, weak_input_validation

['TEE_MemMove(&pkcs11_ref, ref_attr, sizeof(pkcs11_ref));']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:344

フェーズ: ['unknown']

詳細: ['Copies prefix string from prefix (possibly REE-origin) into local prefix2 buffer without explicit max bound beyond prefix_len', 'copies prefix into prefix2 using prefix_len+1; if prefix_len derived from unvalidated source this may overflow prefix2', 'Copies prefix into preallocated buffer using prefix_len+1 provided by caller; binding of src/dst origins recorded', 'Copies prefix string into prefix2 using prefix_len+1; must ensure prefix_len is valid to avoid overflow.', 'Copies prefix into prefix2 using prefix_len computed elsewhere; dest buffer and prefix_len must be consistent to avoid overflow', 'Copies prefix string into prefix2 buffer using prefix_len+1; relies on prefix_len correctness and destination sizing.', 'Copies prefix bytes into prefix2 buffer; boundaries depend on prefix_len computed earlier — ensure prefix_len is validated before copy.', 'Copies prefix into prefix2 (both likely TA buffers); operation appears internal and not REE-driven but still performs raw memory copy.', 'Copies prefix bytes into prefix2 using prefix_len provided by caller; caller must ensure prefix_len bounds, otherwise memory corruption possible', 'Copies prefix bytes into preallocated prefix2 buffer; caller must ensure prefix_len+1 fits destination to avoid overflow', 'Copies prefix+1 bytes into prefix2 based on prefix_len computed earlier; source origin not validated here and destination sizing must be ensured by caller', 'Copies prefix bytes into prefix2 using prefix_len+1 as length; origin/provenance of prefix is unclear and prefix2 size assumptions not shown here', 'Copies prefix into caller-provided prefix2 buffer; dest provenance depends on caller and length calculation uses prefix_len', 'Copies prefix bytes into prefix2 buffer; length derived from prefix_len may allow out-of-bounds if prefix_len incorrect.', 'Copies prefix string into prefix2 buffer using prefix_len+1; depends on caller-provided prefix_len being correct', "Destination 'prefix2' is TA-allocated buffer; writes prefix bytes into it.", "Source 'prefix' is provided by caller; origin region unknown (could be REE-visible or TA-private).", 'Copies prefix into prefix2 using prefix_len+1; destination prefix2 sized by caller must be adequate, otherwise overflow risk exists (no explicit check here).', 'Copies prefix string into prefix2 using prefix_len derived elsewhere; origin of prefix may be caller-controlled', 'Copies prefix bytes from prefix (unknown origin) into prefix2 buffer then writes padding; source size used in copy is prefix_len+1', 'Copies logging prefix into prefix2 from prefix (likely TA or REE); potential read from external buffer into local buffer', 'Copies prefix into prefix2 using prefix_len provided by caller logic; bounds depend on prefix_len check upstream.', 'Copies prefix string into prefix2 using prefix_len+1 as length; length derived earlier and used without further upper-bound here', "Call-site binding: dest 'prefix2' is TA buffer, src 'prefix' may be caller or TA data; copies prefix_len+1 bytes without additional runtime bound here.", 'Copies prefix into prefix2; both likely TA-local but length expression (prefix_len + 1) must be correct to avoid overflow', 'copies prefix (REE-provided) into prefix2 buffer using prefix_len+1 without explicit destination-size check here', 'Copies prefix into local buffer without visible destination-size check here.', 'Copies prefix string into prefix2 with length prefix_len+1 where prefix may originate from earlier data; destination is TA buffer', 'copies prefix (src) into prefix2 using prefix_len derived earlier; if prefix originates from REE, length/contents may be untrusted', "Copies prefix bytes into local prefix2 buffer from 'prefix' source; origin of 'prefix' may be caller/REE-provided.", 'Copies prefix string into prefix2; destination is caller buffer and sized by caller, then modified; potential overwrite if sizes incorrect', 'Copies prefix (source possibly caller-provided or from serial data) into prefix2 buffer; length calculation uses prefix_len which may be influenced by input.', 'copies prefix_len+1 bytes from prefix into prefix2 (both likely TA buffers); shows direct buffer copy with computed length', 'Copies prefix bytes within TA-local buffers (prefix2 <- prefix); uses prefix_len+1 as length, bounds depend on prefix_len correctness', 'Call-site binding: copies prefix string into prefix2 buffer; sizes computed with prefix_len (derived earlier).', 'destination prefix2 is local; source prefix may be from parsed data or constant, binding of src/dst at call-site', 'Copies prefix string into prefix2 buffer using prefix_len-based size; origin of prefix may be REE-influenced']

ルール: other, weak_input_validation

['TEE_MemMove(prefix2, prefix, prefix_len + 1);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:352

フェーズ: ['unknown']

詳細: ['Small copy of attribute bytes into local buffer using MIN(pkcs11_ref.size, sizeof(data)); src originates from attribute blob (caller-controlled).', 'loads pkcs11_ref from cur then copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes; pkcs11_ref.size is from parsed data', 'Copies attribute header from cur into pkcs11_ref and then small sample into local data[]; uses MIN(pkcs11_ref.size, sizeof(data)) to limit copy.', 'Copies pkcs11_ref into local struct and then copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes into data; pkcs11_ref.size (from serialized data) controls copy length', 'Copies header then a small sample of attribute bytes into local data[]; source is serialized object memory, destination is stack buffer, size uses MIN(parsed_size, sizeof(data)) limiting copy.', "Copies bytes from cur+sizeof(pkcs11_ref) into small local buffer 'data' using MIN(pkcs11_ref.size, sizeof(data)); pkcs11_ref.size originates from parsed data and parsing relies on head->attrs_size", "Copies into small local buffer 'data' using pkcs11_ref.size derived from parsed input; parsing assumptions may be violated by malformed attrs_size.", 'Reads pkcs11_ref from cur into local structure; source is serialized data within head and may be malformed.', 'Copies MIN(pkcs11_ref.size, sizeof(data)) bytes from cur+sizeof(pkcs11_ref) into local buffer; pkcs11_ref.size read from serialized stream may be maliciously large or malformed.', 'Uses pkcs11_ref.size from serialized stream to bound a copy into a fixed-size local buffer; malformed size could cause logic errors or truncation/over-read concerns.', 'Copies small sample bytes from cur+header into a local data[] for logging; source is TA attribute area computed from cur and pkcs11_ref.size.', 'Copies small preview bytes from serialized attribute payload into local buffer; source pointer computed as cur + sizeof(pkcs11_ref)', 'Copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from serialized payload into a small local buffer; relies on pkcs11_ref.size parsed from data.', 'Copies a bounded portion of serialized data into a small local buffer using MIN; relies on parsed size.', 'Copies small sample bytes from attribute payload into local data array using pkcs11_ref.size as bound; if pkcs11_ref.size is untrusted, MIN is used but initial header read may be malformed.', 'Reads pkcs11_ref header from cur then copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from the following payload; header size used to bound copy but header itself came from untrusted data', 'Copies header into pkcs11_ref from cur without rechecking remaining length; subsequent copy uses MIN(pkcs11_ref.size, sizeof(data)) but header read may be OOB', 'Copies attribute header into local pkcs11_ref from cur (head-derived); then separately copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes into stack buffer — size driven by untrusted metadata', 'Copies header and then up to MIN(pkcs11_ref.size, sizeof(data)) bytes from parsed buffer; pkcs11_ref.size originates from untrusted serialized data and influences copy length', 'Copies pkcs11_ref from cur into local variable; cur is iterating over head built from caller data and size validation relies on loop bounds and pkcs11_ref.size', 'Reads pkcs11_ref from cur via MemMove then copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from cur+sizeof(pkcs11_ref) without validating full bounds', 'Copies small sample bytes from attribute payload into local data buffer using MIN(pkcs11_ref.size, sizeof(data)) — reads untrusted size but bounds with MIN', 'Copies attribute header from cur into pkcs11_ref (local) while iterating template; source may be REE-derived.', 'Copies small sample bytes from cur+sizeof(pkcs11_ref) into local buffer using MIN(pkcs11_ref.size, sizeof(data)); pkcs11_ref.size derived from untrusted data', 'Reads pkcs11_ref from cur then copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from cur+header into data; uses untrusted size for min computation', 'Destination &pkcs11_ref is local stack; writing header from cur.', 'Copies MIN(pkcs11_ref.size, sizeof(data)) bytes from cur+sizeof(pkcs11_ref) into local buffer; pkcs11_ref.size originates from untrusted template bytes and used without an explicit upper-limit validation beyond MIN', "Reads attribute header then copies up to MIN(pkcs11_ref.size, sizeof(data)) into local buffer 'data' — copy is bounded by MIN which mitigates overflow.", 'Reads header from cur then copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from cur+header; pkcs11_ref.size is attacker-controlled if cur is REE-derived and header/payload bounds not fully validated', 'Copies up to MIN(pkcs11_ref.size, sizeof(data)) from cur into local buffer; pkcs11_ref.size is attacker-controlled if head is untrusted and not validated', 'Copies pkcs11_ref.size bytes from cur into local buffer using MIN but pkcs11_ref.size itself was derived from untrusted data without prior validation.', 'Copies small sample bytes from attribute value into local buffer using MIN(pkcs11_ref.size, sizeof(data)); pkcs11_ref.size originates from parsed header', "Copies bytes from attribute payload into a small local buffer 'data' using MIN(pkcs11_ref.size, sizeof(data)); pkcs11_ref.size influences copy length", 'Reads attribute header into pkcs11_ref and then copies up to sizeof(data) bytes from following payload into local data[]; payload length is attacker-controlled via pkcs11_ref.size', 'Copies attribute header into pkcs11_ref from cur; cur may be from serialized object (untrusted), influencing subsequent size calculations', 'Copies pkcs11_ref header from cur into local structure; cur likely points into serialized buffer (caller-controlled).', 'Copies pkcs11_ref header from cur into local struct, then copies following bytes into small local buffer using MIN(pkcs11_ref.size, sizeof(data)) — header-driven length used to bound second copy', 'Copies MIN(pkcs11_ref.size, sizeof(data)) bytes from cur into local data[] using size derived from parsed pkcs11_ref; if pkcs11_ref was attacker-controlled this may under/over-run without extra checks', 'Copies data with length derived from parsed pkcs11_ref.size; if pkcs11_ref is attacker-controlled this may lead to incorrect assumptions about available source bytes.', 'Copies bytes using pkcs11_ref.size derived from parsed input; size origin must be validated.', 'copies pkcs11_ref and up to MIN(pkcs11_ref.size, sizeof(data)) bytes from cur into local structures relying on pkcs11_ref.size parsed from untrusted data', 'Copies pkcs11_ref from cur into local structure without validating that cur+sizeof(pkcs11_ref) is within bounds', 'reads pkcs11_ref header from cur (parsing REE-derived blob) into local pkcs11_ref; subsequent use of pkcs11_ref.size influences other copies', "Copies pkcs11_ref from buffer 'cur' into local structure; 'cur' is parsed serial data (REE-origin).", 'Copies pkcs11_ref from cur into local structure and then copies following bytes into local data array; sources from parsed buffer', 'copies sizeof(pkcs11_ref) from cur into local pkcs11_ref; cur originates from parsed head (possibly REE)', 'Copies pkcs11_ref header from cur (parsed buffer) into local pkcs11_ref; source cur originates from parsed/REE buffer', "Call-site binding: copies pkcs11_ref from serialized buffer 'cur' into local pkcs11_ref; source is template region.", 'destination &pkcs11_ref local, source cur derives from head/serialized data', 'Copies attribute header from cur into pkcs11_ref then copies data into local small buffer; cli-provided sizes drive MIN() used for copy']

ルール: other, weak_input_validation

['TEE_MemMove(&data[0], cur + sizeof(pkcs11_ref), MIN(pkcs11_ref.size, sizeof(data)));', 'TEE_MemMove(&pkcs11_ref, cur, sizeof(pkcs11_ref)); TEE_MemMove(&data[0], cur + sizeof(pkcs11_ref), MIN(pkcs11_ref.size, sizeof(data)));', 'TEE_MemMove(&pkcs11_ref, cur, sizeof(pkcs11_ref));']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:353

フェーズ: ['unknown']

詳細: ['Extracts up to MIN(pkcs11_ref.size, sizeof(data)) bytes into small local buffer, uses MIN to limit copy', 'Copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from serialized attribute payload into small local array; uses MIN as safeguard.', 'Copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from serialized attribute into local buffer; length driven by pkcs11_ref.size parsed from REE-influenced data', 'Copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from serialized attribute into local array; size derived from serialized data affects copy length.', "Copies payload bytes into local 'data' buffer using MIN(pkcs11_ref.size, sizeof(data)); copy length derived from untrusted header but bounded by local buffer size", 'Copies payload into local buffer bounded by MIN(header.size, local_size) — bounded but header itself came from untrusted input.', 'Copies attribute bytes into fixed-size local array using MIN(pkcs11_ref.size, sizeof(data)); source pointer is cur + sizeof(pkcs11_ref) (may be REE-derived)', 'Copies attribute payload into small local buffer using MIN(pkcs11_ref.size, sizeof(data)); pkcs11_ref.size originates from untrusted header parsed earlier', 'Copies a small amount (MIN(pkcs11_ref.size, sizeof(data))) from attribute payload into local data[]; MIN bounds used but provenance of pkcs11_ref.size is from parsed data', "Copies a small sample of attribute bytes from parsed buffer into local 'data' array; source may be untrusted and size is constrained by MIN(...) but provenance remains untrusted", "Copies few bytes of attribute data into local small buffer 'data' using MIN(pkcs11_ref.size, sizeof(data)); source size controlled by pkcs11_ref, which is untrusted.", 'Copies attribute bytes into small local buffer using MIN(pkcs11_ref.size, sizeof(data)); pkcs11_ref.size is attacker-controlled and earlier header read may be unsafe.', 'Destination &data[0] is local small buffer; writes up to MIN(pkcs11_ref.size, sizeof(data)) bytes from template payload.', 'Copies up to MIN(pkcs11_ref.size, sizeof(data)) from attribute payload into local buffer; header-to-payload size relation relies on prior header validity.', "Copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from serialized attribute into small local array 'data' - size is attacker-controlled leading to potential info flow or truncation", 'Copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from serialized area into local small buffer; size derived from parsed header.', 'Copies payload bytes (cur + sizeof(pkcs11_ref)) into small local buffer using MIN(pkcs11_ref.size, sizeof(data)) to limit copy', 'Copies MIN(pkcs11_ref.size, sizeof(data)) bytes from cur+offset into local buffer; pkcs11_ref.size comes from parsed input and must be trusted elsewhere', "Copies MIN(pkcs11_ref.size, sizeof(data)) bytes from cur+sizeof(pkcs11_ref) into stack buffer 'data'; pkcs11_ref.size is derived from parsed REE data and could be manipulated.", 'Copies bytes based on parsed pkcs11_ref.size (from REE) into a fixed stack buffer; though MIN is used, pkcs11_ref parsing must be robust to avoid misinterpretation.', 'copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from cur+sizeof(pkcs11_ref) into local data; size derived from REE-parsed header', 'copies data governed by pkcs11_ref.size parsed from REE blob; parsing-bound size may be attacker-controlled', "Copies a small data fragment from serial buffer into local array 'data'; source originates from REE-provided serial stream.", 'Copies attribute payload into local data buffer using MIN(pkcs11_ref.size, sizeof(data)); size is attacker-controlled via parsed ref', 'copies MIN(pkcs11_ref.size, sizeof(data)) bytes from cur+sizeof(pkcs11_ref) into data; pkcs11_ref.size is derived from parsed input and may be attacker-controlled if not fully validated', 'copies MIN(pkcs11_ref.size, sizeof(data)) bytes where pkcs11_ref.size is attacker-controlled if parsed input not validated', "Copies small data fragment from parsed buffer (cur + sizeof(pkcs11_ref)) into local 'data' array using MIN(pkcs11_ref.size, sizeof(data))", 'Call-site binding: copies up to MIN(pkcs11_ref.size, sizeof(data)) bytes from template area into local data[] buffer.', 'destination &data[0] local, source cur+sizeof(pkcs11_ref) is within parsed buffer; length MIN(pkcs11_ref.size, sizeof(data)) used', 'Copies attribute bytes into local data[] using MIN(pkcs11_ref.size, sizeof(data)); source is parsed buffer influenced by REE']

ルール: other, weak_input_validation

['TEE_MemMove(&data[0], cur + sizeof(pkcs11_ref), MIN(pkcs11_ref.size, sizeof(data)));']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:366

フェーズ: ['unknown']

詳細: ['Copies enum rc into caller memref (REE-visible); structural binding recorded though not sensitive.']

ルール: other

['TEE_MemMove(params[0].memref.buffer, &rc, sizeof(rc));']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:435

フェーズ: ['unknown']

詳細: ["Binding: copies 'ref' into local head variable; 'ref' provenance (caller buffer) not proven TEE-private", 'Copies header struct from ref into local head via memmove; ref source may be REE-managed', "Copies header 'head' from ref (likely caller-provided) into local head variable; binding shows ref origin may be REE-visible.", "copies 'head' structure from ref into local head using sizeof(head); origin of ref may be external but is used unchecked", 'Copies struct head from ref into local head; binds caller ref provenance to destination local variable', 'Copies serialized object header from ref into local head via TEE_MemMove; ref provenance impacts trust (could be TA-managed or external), caller checks follow.', 'Copies serialized head from ref into local head; if ref is attacker-controlled, head.attrs_count may be tainted and affect later logic.', 'Copies head from ref into local head; ref length must match sizeof(head) else behavior is uncertain', "Copies raw header 'ref' into local 'head'; origin of 'ref' is caller-provided data (unknown provenance), so a malformed or attacker-controlled 'ref' could influence local state.", "Copies 'head' structure from external 'ref' into local head via fixed sizeof(head); source 'ref' may be from serialized input and not strongly validated here", 'Copies serialized head from external ref into local head using fixed sizeof(head) without validating source size.', "Copies 'head' structure from ref (serialized) into local head; source serialization may be untrusted and affects attrs_count checks.", "Copies header 'head' from serialized ref into local head variable; ref buffer origin may be caller-provided serialized object", "Copies head struct from external 'ref' into local 'head' without validating origin; malformed or attacker-influenced 'ref' may affect subsequent logic.", 'Copies head struct from ref into local head; ref provenance uncertain and head.attrs_count is used later to branch.', "Copies 'head' from ref (serialized header) into local head without validating ref length first", 'Copies head struct from ref into local head via sizeof(head); ref provenance may be REE or TA-managed', 'Copies serialized head from ref into head local via fixed-size copy; ref provenance may be untrusted and head.attrs_count used later', 'Copies head from ref into local head via sizeof(head); ref provenance may be external and no explicit length check is visible here', "Copies 'head' from ref into local head; ref originates from caller-provided data and may be untrusted", 'Copies serialized head from ref into local head via fixed-size move; if ref is attacker-controlled this aliases attacker data into head fields', "Copies serialized header 'head' from ref into local head variable; ref may be REE-derived leading to untrusted content in local structure.", "Copies head structure from ref into local 'head' using sizeof(head); correctness assumes ref contains a valid head", "Destination &head is local; memmove reads 'ref' into local head struct.", "Copies 'head' struct from ref without validating that ref points to a buffer of sufficient length before reading head.attrs_count/attrs_size.", "Copies into 'pre' which is set to NULL earlier; destination is invalid leading to memory-safety issue (caller misuse), origin of ref may be REE or TA", 'Copies struct head from ref into local head and then indexes head.attrs_count; ref provenance not validated here', "Copies serial object head from 'ref' into local head structure; source may be untrusted buffer", 'Copies head from ref into local head; ref likely points into serialized object buffer whose provenance is upstream', 'Copies head structure from ref into local head; source may be serialized external data, binding untrusted src into TA-local struct', "Copies header from ref into local head; source 'ref' origin unknown (could be REE or TA-owned).", "Copies header 'head' from ref into local head via fixed-size MemMove; source ref may be untrusted", 'Copies head from ref; origin of ref may be external and head.attrs_count used later—binding reflects potential external influence', 'copies ref into head structure; origin of ref may be external and head used afterwards without additional validation', "Copies 'head' struct from ref (source unknown) into local head; origin of ref may be REE-influenced and head used to drive loops", 'copies head structure from ref into local head; both are likely TA-managed at this call-site', "Copies head structure from ref pointer into local 'head'; ref likely points into REE-origin serialized attributes.", 'Copies head from ref into local head variable; ref originates from parsed attribute list', 'copies sizeof(head) from ref into head (binding of destination to local head from ref source)', "Copies 'head' structure from ref into local head variable; correctness depends on validity of ref and size of head", "Call-site binding: copies 'ref' into local 'head' structure; origin of 'ref' uncertain (could be REE-provided serialized data).", 'destination &head is local and receives bytes from ref (origin tied to caller-provided head/new buffers)', 'Copies head structure from ref (unknown provenance) into local head variable; caller-supplied ref may be untrusted']

ルール: other, weak_input_validation

['TEE_MemMove(&head, ref, sizeof(head));']

関数: ['=', 'TEE_MemMove', 'unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:447

フェーズ: ['unknown']

詳細: ['Binding: copies prefix (caller-provided) into pre buffer which may be uninitialized; origin of prefix is external', 'Copies prefix into pre buffer before logging; pre may point into TEEspace but prefix provenance uncertain', 'Copies caller-supplied prefix into pre buffer via TEE_MemMove; origin of pre and prefix may be caller-controlled leading to potential overflow if not validated', 'copies prefix into pre using strlen(prefix) without showing allocation of pre here; destination origin/size unclear (potential overflow)', 'Copies prefix (caller-provided) into pre buffer before logging; records aliasing of caller buffer into local logging buffer', 'Copies prefix string into pre buffer using strlen(prefix) without explicit check of pre capacity at this site (caller must ensure buffer is large enough).', 'Copies prefix into pre buffer for logging; ensure pre is allocated and prefix length sane to avoid overflow or information leak to logs.', "Copies prefix into pre buffer (dest) using strlen(prefix) as length; origin and size of 'pre' not validated here (caller must ensure buffer large enough).", 'Copies prefix into pre buffer using strlen(prefix); source prefix may be attacker-influenced affecting length used', 'Copies prefix into pre buffer (dest) using strlen(prefix) length; dest origin and size must be ensured by caller (potential risk if pre not allocated appropriately)', "Copies prefix into 'pre' which may be a logging buffer; source 'prefix' provenance is uncertain (could be REE-originated), so copy may move untrusted data into TA memory or vice versa depending on caller.", "Copies prefix into 'pre' buffer; source 'prefix' provenance is unclear and destination 'pre' may be TA stack/buffer — length uses strlen(prefix) without explicit destination size here.", 'Copies prefix string into pre buffer using strlen(prefix) without verifying pre capacity here; caller must ensure pre is allocated and large enough', 'Copies prefix into pre buffer before logging; source may be caller-provided and length computed via strlen, rely on prefix validity.', 'Copies strlen(prefix) bytes from prefix (caller-provided) into pre; prefix origin may be REE-visible and length unchecked relative to pre capacity.', 'Copies caller-provided prefix into pre without ensuring pre capacity relative to strlen(prefix).', 'Copies prefix string into pre buffer using strlen(prefix); destination pre may be uninitialized if allocation failed elsewhere', 'Copies prefix into pre buffer before logging; origin and size of pre must be valid to avoid overwrite or logging of untrusted data.', 'Copies prefix into pre buffer before logging; source may be external but the copy itself is an internal memory move used for message composition.', 'Copies prefix bytes into pre using strlen(prefix) (caller-controlled); if pre is NULL or undersized this may cause crash', 'Copies prefix into pre buffer using strlen(prefix) without verifying destination pre size; if prefix is REE-controlled this can overflow', 'Copies strlen(prefix) bytes into pre without shown bounds check; prefix origin may be untrusted leading to potential overflow or unexpected reads', "Copies caller-supplied prefix into 'pre' without verifying pre is non-NULL or large enough here (caller responsibility), creating a potential overwrite or crash", 'Copies prefix into pre using strlen(prefix) bytes; pre destination must be valid and prefix provenance unclear here', 'copies prefix (caller-provided) into pre buffer; binding of pre/prefix origins may be REE or TA depending on caller, risk is aliasing of shared buffers', "Copies prefix into pre buffer before printing; dest 'pre' may be uninitialized if allocation failed—possible sink of unverified memory", 'Copies prefix into pre buffer without explicit bounds check on pre length (caller must ensure pre has space)', "Copies prefix bytes into pre buffer prior to logging; destination 'pre' may be uninitialized leading to potential memmove into invalid memory.", 'Copies a prefix string into pre (caller-provided); origin of pre and prefix may be REE-derived or set earlier—potential aliasing of shared buffer into logging output', 'Copies prefix into pre buffer before logging; depends on prefix buffer being large enough', "Destination 'pre' is local buffer expected to be provisioned; writing prefix bytes into it may overflow if 'pre' not sized correctly.", 'Copies prefix into pre without validating destination capacity here; caller must ensure pre allocated large enough.', 'Copies prefix into pre without validating pre capacity at this site.', 'Copies prefix into pre buffer; destination origin and size not validated here (caller must ensure pre is large enough)', 'Copies prefix into pre using strlen(prefix) without ensuring pre buffer size; pre originates from caller and may be NULL if not allocated.', 'Copies prefix into pre (pre may be uninitialized/NULL) using strlen(prefix) as length; destination origin/size not validated', 'Copies prefix into pre (buffer) for logging; length uses strlen(prefix) which relies on prefix being NUL-terminated', "Copies prefix string into 'pre' buffer; source 'prefix' provenance unclear (possibly REE), and length uses strlen(prefix) without explicit dst size here", 'Copies prefix into pre buffer prior to logging; prefix provenance uncertain and length uses strlen(prefix)', 'Copies prefix into pre (caller-provided buffer) using strlen(prefix) without explicit dst bounds here; destination origin at call-site determines risk.', 'Copies prefix into pre buffer for logging; src may be external and length determined by strlen(prefix) without explicit dst bounds here', "Copies prefix into 'pre' buffer; 'pre' may be REE-visible or TA-owned depending on earlier allocation—origin uncertain.", "Copies prefix into pre using strlen(prefix) without explicit bounds here; if pre's allocation is attacker-controlled or insufficient this may overflow.", 'Copies prefix into pre using strlen(prefix) without explicit local bounds here; potential overflow if pre not sized appropriately', "alias of destination 'pre' bound to local pointer derived earlier; copies prefix (possibly REE-originated) into pre without explicit bounds here", 'Copies prefix (potentially REE-originated) into local buffer without an explicit bounds check at this site.', 'Copies prefix into pre buffer using strlen(prefix) as length; length computed from prefix which may be unbounded relative to pre', "Call-site binding: dest 'pre' may be TA buffer, src 'prefix' origin unclear (could be caller-provided); copies strlen(prefix) bytes which is caller-controlled length.", 'Copies prefix bytes into pre using strlen(prefix) as length; origin of prefix may be untrusted and dst buffer pre provenance/size not shown here', 'Copies prefix using strlen(prefix) into pre where pre buffer provenance/size is not shown here.', 'Copies prefix into pre; prefix may be caller-controlled and length computed by strlen(prefix) should be validated against pre buffer size', 'copies prefix into pre buffer using strlen(prefix) where prefix may be REE-supplied; destination size not evident here', 'Copies prefix into pre for logging; source prefix may be caller-controlled leading to potential oversized copy if prefix length miscomputed', 'Copies strlen(prefix) bytes from prefix (caller-provided) into pre without ensuring pre has adequate size; origin of prefix may be REE-visible.', "Copies prefix bytes into pre using strlen(prefix) without clear bounds on pre's size at this callsite.", 'copies prefix into pre using strlen(prefix) bytes; if prefix pointer originates from REE, length and contents are attacker-controlled', "Copies prefix into 'pre' buffer using strlen(prefix); destination 'pre' origin/size not validated here — potential unsafe write if pre not sized.", "Copies prefix into buffer 'pre' using strlen(prefix) without validating destination size here.", 'Copies prefix into pre buffer for logging; if prefix is attacker-controlled this could lead to unexpected logging content or overflow if pre is undersized', "Copies 'prefix' into 'pre'; source 'prefix' may be external/REE-derived and is used untrusted in logging path.", 'copies strlen(prefix) bytes into pre (pre may be TA buffer but prefix provenance could be REE); binds prefix source to destination pre', 'Copies prefix into pre buffer before logging; prefix provenance uncertain (could be caller-provided), bounds depend on strlen(prefix)', "Call-site binding: copies prefix into 'pre' buffer before logging; origin of prefix uncertain, may be external.", 'destination pre (likely buffer) receives prefix bytes; binding of prefix source to origin shown at call-site', 'Copies prefix into pre buffer for logging; prefix origin may be untrusted leading to log injection risk']

ルール: other, weak_input_validation

['TEE_MemMove(pre, prefix, strlen(prefix));', 'if (prefix) TEE_MemMove(pre, prefix, strlen(prefix));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:1188

フェーズ: ['unknown']

詳細: ["Binding: 'head' parameter receives 'head' (local attributes list) from caller context; origin is TEE-private.", "Binding: 'attr' parameter receives &bbool (local stack variable); callee will write into caller's stack memory.", "Binding: 'attr_size' parameter receives &size (local) controlling buffer size checks inside callee."]

ルール: other

['rc = get_attribute(head, PKCS11_CKA_EXTRACTABLE, &bbool, &size);']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:1237

フェーズ: ['unknown']

詳細: ['Generic pattern: copying into caller-provided buffers can move TA-private or REE-originating data depending on call-site; sizes may be derived from untrusted sources at some sites.', 'Call-site binding (representative): copying local handle into caller-visible out buffer in object.c uses TEE_MemMove to write into REE-visible memory']

ルール: other

['TEE_MemMove(dest, src, n);', 'TEE_MemMove(out->memref.buffer, &obj_handle, sizeof(obj_handle));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:1528

フェーズ: ['unknown']

詳細: ["Binding callee parameter 'head' to caller-provided obj_attrs; attributes derive from REE-provided templates so content is REE-influenced though stored TA-side"]

ルール: other

['return get_bool(head, PKCS11_CKA_PRIVATE);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:2134

フェーズ: ['unknown']

詳細: ['Binding of callee params from caller: &boolval and &boolsize passed; origin of obj->attributes traces to earlier REE-derived object data.']

ルール: other

['rc = get_attribute(obj->attributes, PKCS11_CKA_EXTRACTABLE, &boolval, &boolsize);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:2140

フェーズ: ['unknown']

詳細: ['Binding of callee params from caller: &boolval and &boolsize; underlying attributes may originate from REE buffers.']

ルール: other

['rc = get_attribute(obj->attributes, PKCS11_CKA_SENSITIVE, &boolval, &boolsize);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:2179

フェーズ: ['unknown']

詳細: ['alias of obj->attributes passed into get_bool; origin is object metadata (TA-private) but may reflect earlier REE-provided templates']

ルール: other

['return get_bool(obj->attributes, attr->id);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:2259

フェーズ: ['unknown']

詳細: ['Binding of callee params from caller: &boolval and &boolsize used to retrieve PKCS11_CKA_TRUSTED from obj->attributes (caller-influenced).']

ルール: other

['rc = get_attribute(obj->attributes, PKCS11_CKA_TRUSTED, &boolval, &boolsize);']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:2380

フェーズ: ['unknown']

詳細: ['Reads attribute header into cli_ref and uses cli_ref.size to compute len without proving header+size <= end.']

ルール: weak_input_validation

['TEE_MemMove(&cli_ref, cur, sizeof(cli_ref)); len = sizeof(cli_ref) + cli_ref.size;']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:2456

フェーズ: ['unknown']

詳細: ['Binding of callee params from caller: &key_length and &size passed; key length attribute originates from caller-constructed attrs.', "Call-site binding: 'head' parameter aliases *head (template-derived attributes) which may originate from REE-supplied data", "Call-site binding: 'attr' parameter (&key_length) is TA-local destination for retrieved size", "Call-site binding: 'attr_size' parameter (&size) is TA-local and used for bounds reporting/checking"]

ルール: other

['rc = get_attribute(*head, PKCS11_CKA_VALUE_LEN, &key_length, &size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/check_attrs_against_modification (callsite):2414

フェーズ: ['unknown']

詳細: ['alias of head (attributes list) passed into get_bool; head was derived from template which originally came from caller-supplied memref (REE-visible)']

ルール: other

['if (cli_ref.id == PKCS11_CKA_TOKEN && get_bool(head, PKCS11_CKA_TOKEN)) {']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/check_attrs_against_modification (callsite):2423

フェーズ: ['unknown']

詳細: ['alias of obj->attributes passed into get_bool at parent_priv check; obj is TA-managed but derived from earlier handle lookup']

ルール: other

['bool parent_priv = get_bool(obj->attributes, cli_ref.id);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/check_attrs_against_modification (callsite):2424

フェーズ: ['unknown']

詳細: ['alias of head passed into get_bool to obtain obj_priv; head originated from template derived from REE-provided data']

ルール: other

['bool obj_priv = get_bool(head, cli_ref.id);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/check_so_pin_callsite:1164:1164

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed originates from session->token (derived earlier from REE-controlled session handle); origin influences persisted DB content.", "Call-site binding: 'token' argument originates from session->token earlier (influenced by REE-derived session handle); origin influences DB filename resolution.", "Call-site binding: 'out_hdl' argument is &db_hdl (local handle); callee will populate a TEE object handle (TEE-private)."]

ルール: other

['update_persistent_db(token);', 'res = open_db_file(token, &db_hdl);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/check_so_pin_callsite:1175:1175

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed originates from session->token (derived earlier from REE-controlled session handle); origin influences persisted DB content."]

ルール: other

['update_persistent_db(token);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/check_so_pin_callsite:1183:1183

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed originates from session->token (derived earlier from REE-controlled session handle); origin influences persisted DB content."]

ルール: other

['update_persistent_db(token);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/check_so_pin_callsite:1223:1223

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed originates from session->token (derived earlier from REE-controlled session handle); origin influences persisted DB content."]

ルール: other

['update_persistent_db(token);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/check_so_pin_callsite:1234:1234

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed originates from session->token (derived earlier from REE-controlled session handle); origin influences persisted DB content."]

ルール: other

['update_persistent_db(token);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/check_so_pin_callsite:1242:1242

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed originates from session->token (derived earlier from REE-controlled session handle); origin influences persisted DB content."]

ルール: other

['update_persistent_db(token);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/close_ck_session (call site):693

フェーズ: ['unknown']

詳細: ['obj pointer from session->object_list (TA-private) is passed into destroy_object; alias of internal object into helper.']

ルール: other

['destroy_object(session, LIST_FIRST(&session->object_list), true);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/close_ck_session (call site):1372

フェーズ: ['unknown']

詳細: ['obj iterator-derived pointer from sess->object_list (TA-private) passed into destroy_object; binding of iterator element into helper.']

ルール: other

['destroy_object(sess, obj, true);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/destroy_object (call site):156

フェーズ: ['unknown']

詳細: ["session->token (TA-private) passed as 'token' parameter into unregister_persistent_object; alias of internal token structure into helper.", "obj->uuid (object-internal UUID, TA-private) passed as 'uuid' parameter into unregister_persistent_object; alias of internal UUID pointer."]

ルール: other

['if (unregister_persistent_object(session->token, obj->uuid) &&']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:59

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed into open_db_file is alias of caller's token (originates from TA state possibly influenced by REE-derived token_id)."]

ルール: other

['res = open_db_file(token, &db_hdl);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:72

フェーズ: ['unknown']

詳細: ['Copies TA-local version array into caller-provided out->memref.buffer (REE-visible); bounds checked against out->memref.size', 'Binding: callee dest parameter aliases caller-provided out->memref.buffer (shared/REE-visible)', 'Binding: callee src parameter aliases local ver array (TEE-private)']

ルール: other

['TEE_MemMove(out->memref.buffer, ver, sizeof(ver));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:115

フェーズ: ['unknown']

詳細: ["Call-site binding: 'args' parameter aliases ctrlargs derived from ctrl->memref.buffer (caller-provided shared buffer)."]

ルール: other

['rc = serialargs_get(args, &head, sizeof(head));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:136

フェーズ: ['unknown']

詳細: ["Call-site binding: 'args' parameter aliases ctrlargs derived from ctrl->memref.buffer (caller-provided shared buffer)."]

ルール: other

['rc = serialargs_get(args, &attr, sizeof(attr));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:158

フェーズ: ['unknown']

詳細: ['alias of head passed from caller into callee; head may reference buffers originating from REE/shared memory', 'alias of attr (attr_ptr) argument from caller passed for writing; callee writes pointers into this buffer', 'alias of attr_size argument from caller passed for writing sizes; callee writes pkcs11_ref.size into it', 'alias of count pointer passed from caller; callee updates count with number of matches']

ルール: other

['get_attribute_ptrs(head, attribute, attr_ptr, attr_size, &count);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:163

フェーズ: ['unknown']

詳細: ["Call-site binding: 'args' parameter aliases ctrlargs derived from ctrl->memref.buffer (caller-provided shared buffer).", 'alias of caller-provided serialargs passed into serialargs_get at another callsite (session_handle read); args originates from REE-visible buffer', "Alias of caller-provided serialargs 'args' (derived from REE memref buffer) passed into serialargs_get; reads src pointer from it (untrusted input).", "Binding callee 'out' to caller-&session_handle (TA-local) at call-site; callee writes to caller-provided out buffer."]

ルール: other, weak_input_validation

['rv = serialargs_get(args, &session_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:277

フェーズ: ['unknown']

詳細: ["alias of caller-provided 'head' (obj_attrs built from REE-supplied template) passed into this function; origin is REE-visible serialargs buffer"]

ルール: other

['rc = check_created_attrs_against_processing(proc_params->id, head);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:281

フェーズ: ['unknown']

詳細: ["Binding of caller 'session' pointer into callee parameter; origin not proven TEE-private (could be influenced by REE path).", "Binding of caller 'head' (attributes) into callee parameter; head may originate from REE-parsed template or TA-created attrs—origin ambiguous."]

ルール: other

['rc = check_created_attrs_against_token(session, head);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:327

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'args' parameter aliases a serialargs built over ctrl->memref.buffer which is REE-provided/shared buffer.", "Call-site binding: callee 'client' parameter is alias of caller 'client' (origin unclear from call-site).", "Call-site binding: callee 'sess' parameter aliases caller's local &session (TA-private output pointer).", "Call-site binding: callee 'args' parameter aliases a serialargs built over ctrl->memref.buffer (REE-provided/shared).", "Call-site binding: callee 'out' parameter aliases caller local (&session_handle), a TA-private destination."]

ルール: other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session);', 'rv = serialargs_get(args, &session_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:364

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'session' parameter is alias of caller-provided session pointer from entry_create_object; origin region not explicit at call-site.", "Call-site binding: callee 'head' parameter aliases attributes built earlier (origin: parsed from REE template then converted) — record as TEE-private alias of processed REE input.", "Call-site binding: callee 'head' parameter aliases attributes constructed from REE-provided template earlier; record origin as TEE-private converted from REE input.", "Call-site binding: callee 'head' parameter aliases caller's 'head' (attributes built from parsed template); origin is processed from REE input, recorded as TEE-private alias of REE-derived data."]

ルール: other

['rc = check_created_attrs_against_token(session, head);', 'rc = check_attrs_misc_integrity(head);', 'rc = check_created_attrs_against_token(session, head); // -> get_bool(head, ...)']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:366

フェーズ: ['unknown']

詳細: ['Copies local enum rc into caller-provided memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though rc is non-sensitive.', 'Copies local rc into caller-provided memref.buffer (REE-visible); structural information-flow to REE observed on different line.', 'Local return code rc is copied into params[0].memref.buffer (REE-visible); verify that no sensitive TA-private data is later written to REE here.', 'Copies local rc into caller memref (REE-visible); destination is shared but rc is non-sensitive.', 'Copies local rc into caller-provided memref.buffer (REE-visible); destination is shared/REE-visible though rc is non-sensitive.', 'Copies local rc into caller-provided params[0].memref.buffer (REE-visible); structural info flow to REE (rc is public/non-sensitive).', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); destination is shared/REE-visible though rc is non-sensitive', 'Copies local rc value into caller-provided params[0].memref.buffer (REE-visible); rc is non-sensitive but destination is shared.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); destination is shared/REE-visible though rc is non-sensitive.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); rc is non-sensitive but operation writes into shared memory.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); destination is shared though rc is non-sensitive.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible) via TEE_MemMove; destination is shared though rc is non-sensitive.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); structural REE-facing write recorded though rc appears non-sensitive.', 'Copies local rc into caller-provided memref.buffer (REE-visible); destination is shared but data is non-sensitive status code.', 'Copies local rc into caller memref output buffer; destination is REE-visible but data is non-sensitive status code.', 'Copying local rc into caller-provided memref.buffer (REE-visible) — destination is shared though data appears non-sensitive.', 'Copies local rc into caller-provided memref.buffer (REE-visible); structural output to REE though rc is non-sensitive.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); structural information-flow to REE-visible memory.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); destination is shared/REE-visible though rc appears non-sensitive.', 'Copies local enum rc into caller-provided params[0].memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though rc is non-sensitive.', 'Copies local rc into caller-provided memref.buffer (REE-visible); destination is shared even though rc is not sensitive.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); destination is shared even though rc is non-sensitive.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible) at end of command handling.', 'Copies local rc into caller-provided REE-visible memref.buffer; destination is shared/REE-visible though data appears non-sensitive.', 'Copies local enum rc into caller-provided REE-visible buffer; destination is shared/REE-visible which is a data-leak channel though rc is non-sensitive.', 'Copies rc into caller-provided memref.buffer (REE-visible); destination is shared but rc is non-sensitive.', 'Copies local rc into caller-provided memref.buffer (REE-visible); destination is shared even though rc is non-sensitive.', 'Copies local rc value into caller-provided REE-visible memref.buffer; structural link to REE output channel (non-sensitive here).', 'Copies local rc into caller-provided memref.buffer (REE-visible); destination is shared/REE-visible though rc is non-sensitive', 'Copies local rc into caller-provided params[0].memref.buffer (REE-visible); size checked earlier but destination is shared memory.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though rc is non-sensitive', 'Copies enum rc into caller-provided params[0].memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible.', 'Binding: callee dest parameter aliases caller-provided params[0].memref.buffer (shared/REE-visible)', 'Binding: callee src parameter aliases address of local rc (TEE-private)', 'Copies local rc into caller-provided params[0].memref.buffer; bounds not provably checked against sizeof(rc) at this call site in the same function path (params[0].memref.size was checked earlier but different call paths may reach here).', 'Copies local rc into caller-provided params[0].memref.buffer (REE-visible).', 'Copies local rc into caller-provided params[0].memref.buffer (shared/REE-visible destination).', 'Copies local rc into caller-provided params[0].memref.buffer (REE-visible); destination is shared though rc is non-sensitive.', 'Copies local rc into caller-provided REE-visible memref.buffer via TEE_MemMove; destination is shared/REE-visible.', 'Copies TA-local rc into caller-provided REE-visible memref.buffer via TEE_MemMove; destination is shared.', 'Copies local rc into caller-provided REE-visible buffer; structurally exposes TA state to REE (rc is non-sensitive here).', 'Copies local rc into caller-provided memref.buffer (REE-visible); structural risk recorded though rc is non-sensitive.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); destination is shared though rc is non-sensitive', 'Copies rc into caller-provided memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though rc is non-sensitive.', 'Copies local rc into caller-provided memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though rc is non-sensitive.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); structural risk of leaking status to REE.', 'Copies local return code into caller-provided params[0].memref.buffer (REE-visible); structural risk since destination is shared memory.', 'Copies local enum rc into caller-provided memref.buffer (REE-visible); structural risk of exposing TA state to REE if semantics change.', 'Copies rc into caller-provided params[0].memref.buffer (REE-visible); structural binding from TA to REE.', 'Copies local rc into caller-provided memref.buffer (REE-visible); rc is non-sensitive but this is a structural REE write.']

ルール: other

['TEE_MemMove(params[0].memref.buffer, &rc, sizeof(rc));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:368

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'session' parameter aliases caller's session pointer; session is a TA-side session object (TA-private).", "Call-site binding: callee 'head' parameter aliases caller-provided attributes pointer; origin may be REE-provided template or TA-owned object attributes (ambiguous)."]

ルール: other

['rc = check_access_attrs_against_token(session, head);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:377

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' parameter is alias of caller's token (TA-managed) passed into open_db_file.", "Call-site binding: '&db_hdl' is caller-local TEE_ObjectHandle passed to receive object handle."]

ルール: other

['res = open_db_file(token, &db_hdl);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:417

フェーズ: ['unknown']

詳細: ["alias of shared ctrlargs (backed by ctrl->memref.buffer from REE) passed as 'args' into function", 'client pointer passed through from caller into callee; origin not validated here', "caller supplies address of local session pointer as output parameter (&session) bound into callee 'sess'", "alias of caller-provided serialargs structure (backed by REE memref buffer) passed as 'args' into serialargs_get", "caller passes address of local session_handle as 'out' parameter into serialargs_get"]

ルール: other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session);', 'rv = serialargs_get(args, &session_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:422

フェーズ: ['unknown']

詳細: ["Binding callee parameter 'args' to caller-controlled serialargs backed by ctrl->memref.buffer (shared/REE-visible); origin is shared buffer passed into helper.", "Binding callee parameter 'client' to caller-provided client (originated from tee_session2client); provenance not proven TEE-private.", "Binding callee parameter 'sess' to caller's &session (callee writes back a pointer to TA-private session), origin is TEE-private local in caller."]

ルール: other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:425

フェーズ: ['unknown']

詳細: ["alias of caller's serialargs object (ctrlargs) originating from REE memref buffer passed into callee as args", "alias of caller's serialargs object (&ctrlargs) passed into serialargs_get; origin is REE-provided memref buffer from TA entry path", 'alias of serialargs object (ctrlargs) originating from REE memref buffer passed as args into alloc_and_get', 'orig_next (pointer into REE-controlled args->next) passed into alloc_and_get as orig_next alias', 'buf0 points to attr read from REE-controlled serialargs and is forwarded into alloc_and_get (copied into heap)']

ルール: other

['rc = serialargs_alloc_get_attributes(&ctrlargs, &pub_template);', 'rc = serialargs_get(&ctrlargs, &attr, sizeof(attr));', 'rc = alloc_and_get(args, orig_next, &attr, sizeof(attr), &p, attr.attrs_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:429

フェーズ: ['unknown']

詳細: ['alias of caller-local pointer (&priv_template) passed as out parameter into callee']

ルール: other

['rc = serialargs_alloc_get_attributes(&ctrlargs, &priv_template);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:441

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' parameter is alias of TA-managed token from caller at this site.", "Call-site binding: '&db_hdl' is caller-local handle passed for output."]

ルール: other

['res = open_db_file(token, &db_hdl);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:447

フェーズ: ['unknown']

詳細: ["Binding callee 'session' parameter to caller session (derived in TA); origin is TA-internal but provenance from caller; treated as TEE-private.", "Binding callee 'head' parameter to caller object->attributes; attributes are TA-owned object metadata (treated as TEE-private)."]

ルール: other

['rc = check_access_attrs_against_token(session, object->attributes);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:476

フェーズ: ['unknown']

詳細: ['alias of pub_head pointer from caller passed into callee; origin is TA-created but ultimately derived from templates that may include REE-originated data', 'alias of priv_head pointer from caller passed into callee; origin is TA-created but may reference attributes sourced from REE buffers']

ルール: other

['rc = add_missing_attribute_id(&pub_head, &priv_head);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:485

フェーズ: ['unknown']

詳細: ["alias of caller-provided 'pub_head' (from parsed template) passed into function; underlying bytes originate from REE serialargs"]

ルール: other

['rc = check_created_attrs_against_processing(proc_params->id, pub_head);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:489

フェーズ: ['unknown']

詳細: ["alias of caller-provided 'priv_head' passed into function; originates from REE-provided template data"]

ルール: other

['rc = check_created_attrs_against_processing(proc_params->id, priv_head);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:515

フェーズ: ['unknown']

詳細: ['Call-site passes ctrlargs initialized from caller memref.buffer (shared/REE-visible) into serialargs_get as args — alias of shared buffer passed into helper', 'Call-site binds callee out pointer to caller stack variable (destination is TA-private)']

ルール: other

['rc = serialargs_get(&ctrlargs, &token_id, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:598

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' argument originates from caller context (TA-managed).", "Call-site binding: '&db_hdl' passed to receive opened object handle (caller-local)."]

ルール: other

['res = open_db_file(token, &db_hdl);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:727

フェーズ: ['unknown']

詳細: ['Alias of shared REE-provided serialargs buffer passed into helper; serialargs_get reads a uint32_t handle from it (untrusted input).', "Binding callee parameter 'client' from caller; origin (tee_session2client-derived) is unclear at this call-site.", 'Output binding: caller passes &session (TA-local) as sess parameter; callee writes *sess = session.']

ルール: weak_input_validation, other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:798

フェーズ: ['unknown']

詳細: ["callee 'args' parameter aliases caller's serialargs pointing into ctrl->memref.buffer (REE-visible), allowing REE-originated bytes to drive session_handle", "callee 'client' parameter is bound from caller-provided client (origin from tee_session2client); client may be REE-derived/tainted", "callee 'sess' out-parameter binds to caller's &session (TEE-private), receiving TA-selected session pointer", "callee 'args' aliases caller serialargs pointing into ctrl->memref.buffer (REE-visible); src is derived from REE-origin bytes.", "callee 'out' parameter binds to caller's &session_handle (TA-private stack) receiving bytes from serialargs_get.", "callee 'size' argument is caller-supplied (sizeof(uint32_t)) driving copy length; size originates from call-site constant but relates to REE-provided buffer length."]

ルール: other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session);', 'rc = serialargs_get(args, &session_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:840

フェーズ: ['unknown']

詳細: ['Call-site binding: args (ctrlargs) originates from caller memref buffer (shared REE-visible) passed into serialargs_get.']

ルール: other

['rc = serialargs_get(&ctrlargs, &token_id, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:908

フェーズ: ['unknown']

詳細: ["Call-site binding: callee parameter 'token' is alias of caller's token (originates from TA but influenced by REE-derived token_id)."]

ルール: other

['update_persistent_db(token);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:946

フェーズ: ['unknown']

詳細: ["alias of callee parameter 'args' bound to caller '&ctrlargs' which was initialized from ctrl->memref.buffer (REE-provided shared buffer)", "alias of callee parameter 'out' bound to caller '&object_handle' (TA-local stack variable)"]

ルール: other

['rc = serialargs_get(&ctrlargs, &object_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:955

フェーズ: ['unknown']

詳細: ["alias of caller-provided 'head' passed into function at another call-site; origin from REE-constructed attrs"]

ルール: other

['rc = check_created_attrs_against_processing(proc_params->id, head);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:960

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' argument is alias of TA-managed token structure passed into callee."]

ルール: other

['if (unregister_persistent_object(token, obj->uuid) &&']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:961

フェーズ: ['unknown']

詳細: ["Call-site binding: 'uuid' argument is alias of obj->uuid from token object list (TA-owned)."]

ルール: other

['unregister_persistent_object(token, obj->uuid))']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:998

フェーズ: ['unknown']

詳細: ['caller passes &object_handle as out parameter (TEE-private) to serialargs_get; binding records origin', 'caller-provided args (&ctrlargs) originated from ctrl->memref.buffer (REE-visible); binding records shared buffer passed into serialargs_get', 'binding: caller-provided args (&ctrlargs) originated from ctrl->memref.buffer (REE-visible); shared buffer passed into serialargs_get']

ルール: other

['rc = serialargs_get(&ctrlargs, &object_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1002

フェーズ: ['unknown']

詳細: ['alias of caller-provided serialargs (ctrlargs derived from params->memref.buffer) passed into callee; origin is REE-visible shared memory', 'alias of callee out-parameter bound to &template (TEE-private) at call-site', "caller-provided 'args' (ctrlargs derived from params->memref.buffer) is passed as serialargs pointer; origin is REE-visible shared memory", 'out parameter is &attr (callee stack) bound to caller local; destination is TEE-private', 'caller-provided serialargs pointer (args) originates from REE-visible memref buffer and is passed into alloc_and_get']

ルール: other

['rc = serialargs_alloc_get_attributes(&ctrlargs, &template);', 'rc = serialargs_get(args, &attr, sizeof(attr));', 'rc = alloc_and_get(args, orig_next, &attr, sizeof(attr), &p, attr.attrs_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1028

フェーズ: ['unknown']

詳細: ['alias of caller-provided session pointer passed into callee; session provenance includes REE-derived handle earlier in call chain', 'alias of caller-provided obj->attributes passed into callee; attributes originate from TA object but ultimately from earlier REE inputs']

ルール: other

['rc = check_access_attrs_against_token(session, obj->attributes);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1050

フェーズ: ['unknown']

詳細: ["Call-site binding: 'pin' argument originates from caller-provided buffer (REE-visible PIN).", "Call-site binding: 'salt' argument is a pointer into TA-private token DB (destination for salt).", "Call-site binding: 'hash' buffer argument is TA-private storage for PIN hash."]

ルール: other

['rc = hash_pin(user_type, new_pin, new_pin_size, &token->db_main->so_pin_salt, token->db_main->so_pin_hash);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1055

フェーズ: ['unknown']

詳細: ['alias of caller session pointer passed into callee; session origin is upstream and may be tainted/unknown', 'alias of caller-provided head (attributes list) passed into callee; head was created from template derived from REE memory', 'alias of callee obj pointer passed in; obj is a TA-managed object (TEE-private) but originated from handle derived earlier', 'alias of obj pointer passed into callee; obj is TA-managed but originated from handle resolution upstream']

ルール: other

['rc = check_attrs_against_modification(session, head, obj, function);', 'if (!attribute_is_modifiable(session, &cli_ref, obj, class, function))']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1062

フェーズ: ['unknown']

詳細: ["Call-site binding: 'pin' argument originates from caller-provided buffer (REE-visible PIN).", "Call-site binding: 'salt' argument is a pointer into TA-private token DB (destination for salt).", "Call-site binding: 'hash' buffer argument is TA-private storage for PIN hash."]

ルール: other

['rc = hash_pin(user_type, new_pin, new_pin_size, &token->db_main->user_pin_salt, token->db_main->user_pin_hash);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1083

フェーズ: ['unknown']

詳細: ['args (serialargs*) is alias of caller-controlled memref buffer initialized from REE-visible params; shared buffer passed into helper.', 'client pointer (from tee_session2client) is forwarded into callee; origin is TA-internal but tainted by caller context.', 'sess (output pointer) is caller-provided stack pointer &session; callee writes *sess = session which binds TA-private session into caller context.']

ルール: other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1106

フェーズ: ['unknown']

詳細: ['serialargs struct (args) originates from caller memref buffer (REE-shared) and is forwarded into this helper; record alias binding.', 'client pointer provided by caller is forwarded into helper; origin uncertain (derived from TA entry), record binding.', 'address of caller-local session variable (&session) is passed for output; callee writes TEE-private session pointer back to caller.']

ルール: other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1110

フェーズ: ['unknown']

詳細: ["Call-site binding: 'args' parameter aliases ctrlargs initialized from caller ctrl->memref.buffer (caller REE-provided memref), so callee reads REE-visible bytes.", "Call-site binding: 'client' parameter is caller's client (origin from tee_session2client) with unclear region/provenance.", "Call-site binding: 'sess' parameter is address of caller-local 'session' (TEE-private); callee writes back a session pointer into caller space.", "Call-site binding: callee 'args' parameter aliases ctrlargs initialized from ctrl->memref.buffer (caller REE-provided memref), so callee reads from REE-visible buffer.", "Call-site binding: callee 'out' parameter is address of local session_handle (TEE-private) so callee writes parsed value into caller-local storage."]

ルール: other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session);', 'serialargs_get(&ctrlargs, &session_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1114

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'args' parameter receives address of ctrlargs initialized from ctrl->memref.buffer (caller-controlled REE buffer)", "Call-site binding: callee 'out' parameter aliases caller stack variable '&object_handle' (TA-private destination for data parsed from REE-provided buffer)"]

ルール: other

['rc = serialargs_get(&ctrlargs, &object_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1128

フェーズ: ['unknown']

詳細: ['Caller-provided params.memref.buffer (pin) is forwarded into set_pin as new_pin; alias of REE-visible buffer recorded.']

ルール: other

['return set_pin(session, pin, pin_size, PKCS11_CKU_USER);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1134

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'head' aliases obj->attributes from caller (TA-private object attributes passed into helper).", "Call-site binding: callee parameter 'head' aliases obj->attributes from caller (TA-private object attributes passed into get_bool)."]

ルール: other

['if (object_is_token(obj->attributes) && !pkcs11_session_is_read_write(session)) {', 'return get_bool(head, PKCS11_CKA_TOKEN);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1137

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'args' parameter aliases ctrlargs initialized from ctrl->memref (caller-provided REE buffer).", "Call-site binding: callee 'client' parameter is alias of caller 'client' (origin derived from tee_session); provenance uncertain.", "Call-site binding: callee 'sess' parameter receives address of local session (TA-private destination).", "Call-site binding: 'args' parameter aliases ctrlargs initialized from ctrl->memref (caller-provided REE buffer).", "Call-site binding: 'out' parameter is address of local session_handle (TA-private destination)."]

ルール: other

['serialargs_get_session_from_handle(&ctrlargs, client, &session);', 'rv = serialargs_get(args, &session_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1141

フェーズ: ['unknown']

詳細: ["Call-site binding: 'args' parameter receives address of ctrlargs (TA struct that references REE-provided buffer).", "Call-site binding: 'out' parameter is &wrapping_key_handle (TA-private destination for data copied from args buffer).", "Call-site binding: 'size' parameter is sizeof(uint32_t) (caller-provided scalar)."]

ルール: other

['rc = serialargs_get(&ctrlargs, &wrapping_key_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1144

フェーズ: ['unknown']

詳細: ["Call-site binding: 'session' parameter aliases a session derived from ctrl buffer (which originates from REE), so session is REE-influenced.", "Call-site binding: 'head' parameter aliases obj->attributes which is TA-private attributes storage."]

ルール: other

['rc = check_access_attrs_against_token(session, obj->attributes);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1149

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'args' parameter aliases ctrlargs derived from ctrl->memref.buffer (caller-provided shared buffer).", "Call-site binding: callee 'out' parameter is &proc_params (TA-private pointer out on stack) passed by caller."]

ルール: other

['rc = serialargs_alloc_get_one_attribute(&ctrlargs, &proc_params);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1151

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'head' parameter aliases obj->attributes (TA-private object attributes) passed from entry_copy_object."]

ルール: other

['if (!object_is_copyable(obj->attributes)) {']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1171

フェーズ: ['unknown']

詳細: ["Call-site binding: 'session' parameter aliases session derived from caller (originates from ctrl buffer -> possible REE influence)", "Call-site binding: 'head' parameter aliases attributes built from template that originated from REE-supplied ctrl buffer", "Call-site binding: 'obj' parameter is TA object pointer from handle lookup (TA-private)", "Call-site binding: 'session' parameter aliases session derived earlier (origin traces to ctrl buffer/session lookup)", "Call-site binding: 'req_attr' (&cli_ref) aliases parsed attribute header coming from REE-supplied head buffer"]

ルール: other

['rc = check_attrs_against_modification(session, head, obj, function);', 'if (!attribute_is_modifiable(session, &cli_ref, obj, class, function))']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1200

フェーズ: ['unknown']

詳細: ['Call-site binding: proc_params->id (proc_id) passed from caller; origin derived from parsed ctrl args (caller-controlled).', "Call-site binding: 'function' argument forwarded from upstream (processing_func) — caller-controlled enum.", "Call-site binding: wrapping_key->attributes passed as 'head' — alias of object attributes (TA-held) but contents originate from object state; origin considered TEE-private."]

ルール: other

['rc = check_parent_attrs_against_processing(proc_params->id, function, wrapping_key->attributes);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1223

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed to update_persistent_db is alias of TA-internal token (origin TA-private) from check_user_pin."]

ルール: other

['update_persistent_db(token);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1234

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed to update_persistent_db is alias of TA-internal token (origin TA-private) from check_user_pin."]

ルール: other

['update_persistent_db(token);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1242

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed to update_persistent_db is alias of TA-internal token (origin TA-private) from check_user_pin."]

ルール: other

['update_persistent_db(token);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1247

フェーズ: ['unknown']

詳細: ["Call-site binding: 'head' parameter aliases wrapping_key->attributes (object attributes) from caller; origin is TA object storage (TA-private).", "Call-site binding: 'attribute' parameter is a compile-time constant (PKCS11_CKA_WRAP_TEMPLATE) from caller; non-sensitive scalar.", "Call-site binding: 'attr_ptr' parameter is &req_attrs (caller local); callee may store pointer into caller variable (alias of TA-private stack/heap).", "Call-site binding: 'attr_size' parameter is &size (caller local uint32_t); callee writes size back to caller-controlled variable."]

ルール: other

['rc = get_attribute_ptr(wrapping_key->attributes, PKCS11_CKA_WRAP_TEMPLATE, &req_attrs, &size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1250

フェーズ: ['unknown']

詳細: ["Call-site binding: 'candidate' parameter aliases key->attributes (TA-private) passed from caller.", "Call-site binding: 'ref' parameter aliases req_attrs (origin from wrapping key attribute retrieval); origin considered TEE-private."]

ルール: other

['if (!attributes_match_reference(key->attributes, req_attrs)) {']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1256

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'head' parameter aliases key->attributes from TA object (origin TA-private attributes).", "Call-site binding: callee 'data' parameter is &key_data (TA-private out pointer) passed by caller.", "Call-site binding: callee 'sz' parameter is &key_sz (TA-private size out parameter) from caller."]

ルール: other

['rc = alloc_key_data_to_wrap(key->attributes, &key_data, &key_sz);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1266

フェーズ: ['unknown']

詳細: ["Call-site binding: 'session' passed from caller; origin tied to TA session (unknown region here).", "Call-site binding: 'key_data' passed from caller; originates from TA-private key material (sensitive).", "Call-site binding: 'key_sz' scalar provided by caller-path; size influences copies.", "Call-site binding: 'out_buf' aliases caller-provided params[2].memref.buffer (REE-visible shared).", "Call-site binding: '&out_size' aliases params[2].memref.size (REE-tainted) allowing callee to read/modify REE-provided length."]

ルール: other

['rc = wrap_data_by_symm_enc(session, key_data, key_sz, out_buf, &out_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1269

フェーズ: ['unknown']

詳細: ["Call-site binding: 'args' parameter aliases caller memref buffer (shared/REE-visible serialargs state).", "Call-site binding: 'client' parameter originates from caller (tee_session-derived); provenance is from entry and thus unclear.", "Call-site binding: 'sess' out-parameter is caller stack pointer receiving session alias; origin inside TA (callee writes *sess)."]

ルール: other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1300

フェーズ: ['unknown']

詳細: ["Call-site binding: 'session' argument is alias of session obtained earlier in entry_ck_set_pin (TA-private origin from session store).", "Call-site binding: 'old_pin' argument aliases data parsed from caller-provided memref (shared/REE-visible buffer).", "Call-site binding: 'old_pin_size' is derived from REE-provided fields and influences internal checks."]

ルール: other

['rc = check_so_pin(session, old_pin, old_pin_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1306

フェーズ: ['unknown']

詳細: ['Caller-provided pin pointer passed to set_pin for SO; origin is REE memref buffer so binding is recorded.', "Call-site binding: 'session' argument aliases TA session object derived in caller; origin is TA-private session structure.", "Call-site binding: 'pin' argument aliases buffer read from caller params (shared/REE-visible), so new_pin originates from REE."]

ルール: other

['return set_pin(session, pin, pin_size, PKCS11_CKU_SO);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1319

フェーズ: ['unknown']

詳細: ['Caller-provided pin pointer passed to set_pin for USER; alias of shared buffer recorded.', "Call-site binding: 'session' argument aliases TA session object derived in caller; origin is TA-private session structure.", "Call-site binding: 'pin' argument aliases buffer read from caller params (shared/REE-visible), so new_pin originates from REE."]

ルール: other

['return set_pin(session, pin, pin_size, PKCS11_CKU_USER);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1468

フェーズ: ['unknown']

詳細: ["Call-site binding: 'session' argument (from entry path) passed to check_so_pin again; same aliasing risk noted earlier.", "Call-site binding: 'pin' argument aliases caller-provided buffer (shared/REE-visible) containing new PIN.", "Call-site binding: 'session' argument is alias of session handle derived earlier from REE-supplied serial args; origin region unclear but influences token DB access.", "Call-site binding: 'pin' is alias of REE-provided buffer extracted earlier (pin_size-controlled); pin is a credential and used directly in verify_pin.", "Call-site binding: 'pin_size' is REE-controlled and drives verify_pin length; insufficient additional validation of range/limits here."]

ルール: other, weak_input_validation

['rc = check_so_pin(session, pin, pin_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1487

フェーズ: ['unknown']

詳細: ["Call-site binding: 'session' argument is alias of TA-internal session object created earlier (TA-private origin).", "Call-site binding: 'pin' argument is alias of buffer extracted from caller-provided memref (shared/REE-visible origin)."]

ルール: other

['rc = check_user_pin(session, pin, pin_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1505

フェーズ: ['unknown']

詳細: ["Binding of caller 'head' pointer into get_bool parameter; origin may be REE-derived template or TA-created attrs, origin ambiguous."]

ルール: other

['rc = get_attribute(head, attribute, &bbool, &size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1560

フェーズ: ['unknown']

詳細: ["Call-site binding: 'head' parameter aliases obj->attributes (TA-private attributes), so callee reads TA-private data."]

ルール: other

['private = object_is_private(head);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1584

フェーズ: ['unknown']

詳細: ["Binding of caller 'head' pointer into callee parameter; origin ambiguous (could be derived from REE template), so attribute integrity depends on upstream parsing."]

ルール: other

['rc = check_attrs_misc_integrity(head);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:1635

フェーズ: ['unknown']

詳細: ["Binding of callee 'args' to ctrlargs which was initialized from caller-provided ctrl->memref.buffer (shared/REE-visible); alias of shared buffer passed into helper.", "Binding of callee 'client' to caller 'client' whose provenance is from tee_session2client (tainted/uncertain); records aliasing origin.", "Binding of callee 'sess' to address of caller-local session variable (TA-private); callee will write session pointer back into caller storage."]

ルール: other

['rc = serialargs_get_session_from_handle(&ctrlargs, client, &session); // args binding', 'rc = serialargs_get_session_from_handle(&ctrlargs, client, &session); // client binding', 'rc = serialargs_get_session_from_handle(&ctrlargs, client, &session); // sess binding']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:2102

フェーズ: ['unknown']

詳細: ['Call-site binding: proc_id argument originates from proc_params->id parsed from REE-provided ctrl buffer (caller-controlled).', "Call-site binding: 'head' argument is wrapping_key->attributes (object attributes) — alias of TA-held attributes; origin considered TEE-private."]

ルール: other

['if (!parent_key_complies_allowed_processings(proc_id, head)) {']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:2327

フェーズ: ['unknown']

詳細: ['alias of obj->attributes passed into get_bool; obj is TA-managed (origin from handle resolution) but origin provenance upstream is unknown']

ルール: other

['return get_bool(obj->attributes, req_attr->id);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:2340

フェーズ: ['unknown']

詳細: ["Call-site binding: 'attr' parameter (&cli_ref) aliases parsed attribute header coming from REE-supplied head buffer", "Call-site binding: 'session' parameter aliases session derived earlier (origin traces to ctrl/session lookup)", "Call-site binding: 'obj' parameter is TA object pointer from handle lookup (TA-private)"]

ルール: other

['attr_is_modifiable_secret_key(req_attr, session, obj)']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:2346

フェーズ: ['unknown']

詳細: ['alias of caller-provided req_attr pointer passed into callee; req_attr originates from head derived from REE-supplied buffer', 'alias of caller session pointer passed into callee; session was obtained earlier from serialargs and may be tainted/unknown', 'alias of obj pointer passed into callee; obj is TA-managed but originates from handle resolution upstream', "Call-site binding: 'attr' parameter (&cli_ref) aliases parsed attribute header derived from REE-supplied head buffer", "Call-site binding: 'sess' parameter aliases session established earlier (origin traces to ctrl/session lookup)", "Call-site binding: 'obj' parameter is TA object pointer from handle lookup (TA-private)"]

ルール: other

['attr_is_modifiable_private_key(req_attr, session, obj)']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:2414

フェーズ: ['unknown']

詳細: ["Call-site binding: 'head' parameter aliases 'head' constructed from client-supplied template (originates from ctrl buffer), so callee sees data derived from REE."]

ルール: other

['get_bool(head, PKCS11_CKA_TOKEN)']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:2423

フェーズ: ['unknown']

詳細: ["Call-site binding: 'head' argument in get_bool(obj->attributes, ...) is TA-private attributes pointer derived from object"]

ルール: other

['get_bool(obj->attributes, cli_ref.id)']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:2424

フェーズ: ['unknown']

詳細: ["Call-site binding: 'head' parameter aliases template-derived head (from REE) when checking PKCS11_CKA_PRIVATE"]

ルール: other

['get_bool(head, cli_ref.id)']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:2798

フェーズ: ['unknown']

詳細: ['alias of *pub_head passed from caller into get_attribute_ptr; origin from templates that may contain REE-derived data', 'attr_ptr (address of id1) from caller passed for writing; callee may populate pointer to data possibly backed by shared buffers']

ルール: other

['rc = get_attribute_ptr(*pub_head, PKCS11_CKA_ID, &id1, &id1_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/entry.c:2807

フェーズ: ['unknown']

詳細: ['alias of *priv_head passed from caller into get_attribute_ptr; origin from templates that may contain REE-derived data']

ルール: other

['rc = get_attribute_ptr(*priv_head, PKCS11_CKA_ID, &id2, &id2_size);']

関数: ['array_write']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/handle.c:47

フェーズ: ['unknown']

詳細: ['Writes ptr into db->ptrs[n] (array write); if db->ptrs region is attacker-controlled origin this could overwrite shared memory.']

ルール: other

['if (!db->ptrs[n]) { db->ptrs[n] = ptr; return n; }']

関数: ['array_write']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/handle.c:49

フェーズ: ['unknown']

詳細: ['assignment db->ptrs[n] = ptr writes caller pointer into DB array (possible aliasing of caller memory into handle table)', 'Assignment db->ptrs[n] = ptr inserts caller pointer into handle table (aliasing) which is a structural risk of in-memory aliasing/ownership but does not reach REE here.']

ルール: other

['if (!db->ptrs[n]) { db->ptrs[n] = ptr; return n; }']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/handle.c:64

フェーズ: ['unknown']

詳細: ["Zeroing memory at db->ptrs + db->max_ptrs which is derived from realloc'd db->ptrs; destination is TA heap (private) but origin of db may be uncertain.", 'destination pointer is db->ptrs + db->max_ptrs (caller-managed buffer) being passed to MemFill; origin is reallocated DB array in TA memory', 'fill byte value (0) passed as argument; constant but included for binding completeness', 'size expression derived from db->max_ptrs and new_max_ptrs (caller-controlled); arithmetic influences amount of memory written']

ルール: other

['TEE_MemFill(db->ptrs + db->max_ptrs, 0, (new_max_ptrs - db->max_ptrs) * sizeof(void *));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:136

フェーズ: ['unknown']

詳細: ["Call-site binding: 'out' parameter (&attr) is caller-local TA storage provided to receive bytes"]

ルール: other

['rc = serialargs_get(args, &attr, sizeof(attr));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:163

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'out' parameter is &session_handle (TA-local stack) at caller site; destination is TEE-private local storage.", "caller-provided 'args' passed from upstream call-site (second call) is REE-origin serialargs buffer", "Call-site binding: 'out' parameter (&session_handle) is caller-local TA variable to receive data", "Binding: callee 'args' parameter receives &ctrlargs which was initialized from REE memref buffer -> indirect REE-originated data.", "Binding: callee 'out' parameter is &session_handle (caller stack) — destination for decoded value is TA-local but originates from caller-provided buffer."]

ルール: other

['rv = serialargs_get(args, &session_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:206

フェーズ: ['unknown']

詳細: ['Call-site binding: params array from REE passed into entry_create_object; origin is REE-visible memref']

ルール: other

['rc = entry_create_object(client, ptypes, params);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:209

フェーズ: ['unknown']

詳細: ["Binding caller-provided 'client' into callee; provenance not proven TEE-private."]

ルール: other

['rc = entry_destroy_object(client, ptypes, params);']

関数: ['TEE_CreatePersistentObject', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:257

フェーズ: ['unknown']

詳細: ['Persistent object created from obj->attributes which may include untrusted/REE-derived attribute bytes (template); writing to storage using TEE_CreatePersistentObject', 'Creates persistent object from obj->attributes which may include REE-derived attribute bytes', 'obj->uuid (UUID) pointer from TA object passed into storage API; origin is TA-managed but provenance may include earlier REE-derived data', 'obj->attributes buffer (derived from template/head) passed to persistent-create; may contain REE-derived attribute bytes copied into TA storage', 'address of obj->attribs_hdl passed to API to receive handle; callee will write TA object handle into this location (caller stack/obj)', 'Persistent object creation copies obj->attributes into secure storage; if attributes contain attacker-controlled bytes (from earlier deserialization) this could persist attacker data.', 'Binding of callee parameter for UUID to obj->uuid which was produced in-TA by create_object_uuid (server-side origin); ensure provenance accounted for.', 'Binding of callee parameter for initial object data to obj->attributes; attributes originate from templates parsed earlier (REE-derived then processed), so provenance is mixed/uncertain.', 'Binding of callee out-parameter attribs handle to &obj->attribs_hdl (TA-private storage) so kernel will write back into TA-owned field.']

ルール: other

['TEE_CreatePersistentObject(TEE_STORAGE_PRIVATE, obj->uuid, sizeof(TEE_UUID), tee_obj_flags, TEE_HANDLE_NULL, obj->attributes, size, &obj->attribs_hdl);', 'TEE_CreatePersistentObject(..., obj->attributes, size, &obj->attribs_hdl);', '..., obj->attributes, size, ...', '&obj->attribs_hdl', 'res = TEE_CreatePersistentObject(..., obj->uuid, sizeof(TEE_UUID), ..., obj->attributes, size, &obj->attribs_hdl);', 'res = TEE_CreatePersistentObject(..., obj->attributes, size, &obj->attribs_hdl);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:285

フェーズ: ['unknown']

詳細: ['Assigns generated object handle into caller-provided out_handle.']

ルール: other

['*out_handle = obj_handle;']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:301

フェーズ: ['unknown']

詳細: ['Caller passes params (REE memrefs) into entry_get_attribute_value; these are the origin of tainted data used later.']

ルール: other

['rc = entry_get_attribute_value(client, ptypes, params);']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:366

フェーズ: ['unknown']

詳細: ['Copies local rc to caller-provided params[0].memref.buffer (REE-visible); destination is shared but data is non-sensitive.', 'Copies local rc into REE-visible params[0].memref.buffer; destination is shared with REE (caller).']

ルール: other

['TEE_MemMove(params[0].memref.buffer, &rc, sizeof(rc));']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:390

フェーズ: ['unknown']

詳細: ['Copies local obj_handle into out->memref.buffer (caller-provided REE-visible memref) via TEE_MemMove; destination is shared/REE-visible.', 'Copies obj_handle (non-sensitive) into caller-provided out->memref.buffer (REE-visible); structural info flow to REE but not promoted to unencrypted_output.', 'Copies obj_handle into caller-provided out->memref.buffer (MEMREF_OUTPUT) — structural risk of writing into shared buffer.', 'Copies obj_handle into caller-provided REE-visible out->memref.buffer; structural risk of writing to shared buffer (but obj_handle is non-sensitive)', 'Copies local obj_handle into caller-provided out->memref.buffer (REE-visible); destination is shared but value is non-sensitive.', 'Copies obj_handle (TA-private) into caller-provided out->memref.buffer (REE-visible), exposing TA-created handle to REE.', 'Copies a TA-private obj_handle into caller-provided REE-visible memref (MEMREF_OUTPUT); structural risk but not part of evaluated sink line.', 'Copies local obj_handle into caller-provided REE-visible out->memref.buffer via TEE_MemMove; structural binding of shared output.', 'Binding: destination parameter aliases caller-provided out->memref.buffer (REE-visible) at this call-site.', 'Binding: source parameter is address of local obj_handle (TEE-private) at this call-site.']

ルール: other

['TEE_MemMove(out->memref.buffer, &obj_handle, sizeof(obj_handle));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:508

フェーズ: ['unknown']

詳細: ['ptypes must equal exp_pt (MEMREF_INOUT); caller may pass MEMREF_OUTPUT leading to type mismatch and potential misuse of params as input.']

ルール: weak_input_validation

['if (!client || ptypes != exp_pt)\n    return PKCS11_CKR_ARGUMENTS_BAD;']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:693

フェーズ: ['unknown']

詳細: ['Copies TA-side object handles into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove; writes are bounded by out_count computed from REE size.', 'Copies TA-side object handles into caller-provided out->memref.buffer; writes are bounded by out_count computed from REE-provided size but remain a structural risk.', 'Binding: destination parameter aliases out_handles + count*sizeof(uint32_t); origin unclear at call-site.', 'Binding: source parameter aliases ctx->handles + ctx->next; origin unclear (could be TEE-private or derived from REE).', 'Binding: destination pointer argument aliases caller-provided out_handles (REE-visible memref) allowing TA->REE writes.', 'Binding: source pointer argument references TA-private ctx->handles (internal), aliased into memcpy source.']

ルール: other

['TEE_MemMove(out_handles + count * sizeof(uint32_t), ctx->handles + ctx->next, sizeof(uint32_t));']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:823

フェーズ: ['unknown']

詳細: ["Construction of 'template' from REE-controlled serialargs; any inconsistency in declared attrs_size vs actual data can make subsequent TEE_MemMove calls unsafe."]

ルール: other

['cur = (char *)template + sizeof(struct pkcs11_object_head); end = cur + template->attrs_size;']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:832

フェーズ: ['unknown']

詳細: ['Binding: destination parameter is &cli_head (local stack variable, TEE-private) at this call-site.', 'Binding: source parameter is cli_ref which likely points into caller-provided serialized attributes (REE-visible); treated as shared.', 'TEE_MemMove reads client-supplied attribute header into TA-local cli_head; ctrl data is untrusted and must be validated.', 'Binding: destination &cli_head (TA-private) is written from cli_ref which points into parsed template (origin from REE-controlled params -> template); origin ambiguity.']

ルール: other

['TEE_MemMove(&cli_head, cli_ref, sizeof(cli_head));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:839

フェーズ: ['unknown']

詳細: ['Binding: destination parameter is &cli_ref->size which aliases caller-provided attribute area (REE-visible).', 'Binding: source parameter is &cli_head.size (TEE-private local), copied into potentially REE-visible storage.']

ルール: other

['TEE_MemMove(&cli_ref->size, &cli_head.size, sizeof(cli_head.size));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:854

フェーズ: ['unknown']

詳細: ['Binding: destination parameter is &cli_ref->size (attribute in caller area, REE-visible).', 'Binding: source parameter is &cli_head.size (TEE-private) at this call-site.']

ルール: other

['TEE_MemMove(&cli_ref->size, &cli_head.size, sizeof(cli_head.size));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:886

フェーズ: ['unknown']

詳細: ['Binding: destination parameter is &cli_ref->size (REE-visible attribute area) at this call-site.', 'Binding: source is &cli_head.size (TEE-private) copied into caller-visible attr field.', 'Binding: writes cli_head.size back into cli_ref->size within template (template may originate from REE data parsed earlier).']

ルール: other

['TEE_MemMove(&cli_ref->size, &cli_head.size, sizeof(cli_head.size));']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:910

フェーズ: ['unknown']

詳細: ["Copies 'template' (TA-side object describing attributes, may include sensitive attributes flagged earlier) into out->memref.buffer (REE-visible), potentially exposing attributes.", 'Final copy of template into out->memref.buffer (REE-visible) may expose attribute data if template contains sensitive attributes not filtered earlier.', 'Copies template (attributes) into REE-visible out buffer; may expose sensitive attributes if attr_sensitive was set earlier.', 'Later copies template to REE-visible out->memref.buffer; if template contains sensitive attributes or malformed sizes, there is a structural risk of exposing data or truncation.', 'Template (populated earlier via get_attribute/TEE_MemMove into cli_ref->data) is copied wholesale to REE-visible out->memref.buffer, potentially exposing attributes flagged sensitive.', 'Copies template (attributes) into out->memref.buffer (REE-visible); attributes may include sensitive flags/values if export gating fails.', 'Copies TA-constructed template (which may contain attribute values) into REE-visible out->memref.buffer; this is the actual REE-facing copy that could leak attributes if they are sensitive.', "Copies TA-owned 'template' (which may include attributes marked sensitive earlier) into REE-visible out->memref.buffer, potentially exposing attribute data.", 'Copies TA-side attribute template into REE-visible out buffer; may expose attributes (some earlier logic attempts to mark sensitive/unavailable, but residual risk remains).', "Copies TA-side 'template' (attributes) into REE-visible out->memref.buffer; may expose sensitive attributes flagged earlier.", 'Binding: destination parameter aliases out->memref.buffer (REE-visible) for attribute copy.', 'Binding: source parameter is template which was allocated/filled earlier (likely TEE-private).', 'TEE_MemMove copies template (TA-private) into caller-provided out->memref.buffer; need to ensure attributes are allowed to be exported.', "Binding: copies TA-side 'template' into out->memref.buffer (REE-visible), potentially exposing attributes assembled in TA."]

ルール: other

['TEE_MemMove(out->memref.buffer, template, out->memref.size);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:966

フェーズ: ['unknown']

詳細: ['Copies computed obj_size into out->memref.buffer (caller-provided REE-visible memref) via TEE_MemMove; destination is shared/REE-visible though obj_size is non-sensitive.', 'Copies computed obj_size into REE-visible out->memref.buffer; destination is shared but obj_size is non-sensitive.', 'Copies computed obj_size into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though obj_size is non-sensitive.', 'Copies computed obj_size into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove; destination is shared even though obj_size appears non-sensitive.', 'Binding: destination parameter aliases out->memref.buffer (REE-visible) receiving obj_size.', 'Binding: source parameter is &obj_size (TEE-private local), copied to caller-visible buffer.', 'Binding: writes obj_size (TA-calculated) into out->memref.buffer (REE-visible) — REE-visible destination receives TA data.', 'Binding callee dest to out->memref.buffer which is caller-provided REE-visible memref', 'Binding callee src to &obj_size (TA-local value) passed as source', 'Binding callee len to sizeof(obj_size) immediate value']

ルール: other

['TEE_MemMove(out->memref.buffer, &obj_size, sizeof(obj_size));', 'call-site: TEE_MemMove(out->memref.buffer, &obj_size, sizeof(obj_size));']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:1209

フェーズ: ['unknown']

詳細: ['Copies object attributes from TA-private obj->attributes into freshly allocated TA-private head_new via TEE_MemMove', 'Copies obj->attributes into freshly allocated head_new (TA-private) before modification; risk: attribute handling may later be exposed if not sanitized.', 'Copies object attributes from obj->attributes into newly allocated head_new; ensure template_size computed from attrs_size is correct to avoid overflow.', 'Binding: destination parameter is head_new which is likely TEE-allocated (uncertain), origin ambiguous.', 'Binding: source parameter is obj->attributes (object-internal storage, TEE-private) at this call-site.', 'Binding: copies obj->attributes into head_new (allocation in TA) — src is TA object storage, dst is TA allocation; origin linkage to REE-controlled attributes earlier is possible.', 'Binding callee dest to head_new (allocator-returned buffer) origin unclear', 'Binding callee src to obj->attributes (object-owned attributes, TA-private)', 'Binding callee len to template_size (caller-provided size)', "Call-site binding: destination 'head_new' is TA-allocated (TEE-private) receiving data from TA-private obj->attributes via TEE_MemMove", "Call-site binding: source 'obj->attributes' is TA-private buffer passed into TEE_MemMove"]

ルール: other

['TEE_MemMove(head_new, obj->attributes, template_size);', 'call-site: TEE_MemMove(head_new, obj->attributes, template_size);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:1237

フェーズ: ['unknown']

詳細: ['Copies obj_handle (local, non-sensitive handle) into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove', 'Copies obj_handle into caller-provided out->memref.buffer (REE-visible); not sensitive but structural channel to REE.', 'obj_handle (TA-local) is copied into caller-provided out->memref.buffer (REE-visible); check callers for sensitive data exposure.', 'Copies obj_handle into caller-provided out->memref.buffer (REE-visible); param was checked for size but structural risk of exposing TA-private handles to REE exists.', 'Copies obj_handle into caller-provided out buffer (MEMREF_OUTPUT) — structural output exposure but not promoted to unencrypted_output.', 'Copies obj_handle into caller-provided out buffer (REE-visible); obj_handle is non-sensitive but is a structural REE-visible write.', 'Copies obj_handle into caller-provided out->memref.buffer (REE-visible); confirmed size check earlier ensures out->memref.size == sizeof(obj_handle) but REE-visible destination remains.', 'Copies obj_handle to caller-provided out buffer; checked earlier that out->memref.size == sizeof(obj_handle).', 'Writes obj_handle into caller-provided out->memref.buffer (MEMREF_OUTPUT); not promoted to unencrypted_output since data is non-sensitive.', 'Copies obj_handle into caller-provided out->memref.buffer (REE-visible); needs correct ptypes/size checks (which are present) to avoid misuse.', 'Copies obj_handle into caller-provided out->memref.buffer (REE-visible); potential information flow to REE though obj_handle is non-sensitive.', 'Copies obj_handle into caller-provided out buffer (REE-visible); out->memref.size was validated earlier to equal sizeof(obj_handle).', 'Copies obj_handle into caller-provided out memref; out is REE-visible but obj_handle is non-sensitive.', 'Copies obj_handle into caller-provided out buffer (REE-visible); currently obj_handle is non-sensitive but this is a REE-facing copy.', 'Copies obj_handle into caller-provided out->memref.buffer (REE-visible); noted as structural risk though not promoted to unencrypted_output here.', 'Copies obj_handle into caller-provided out->memref.buffer (REE-visible); structurally notable but not promoted to unencrypted_output.', 'Binding: destination parameter aliases out->memref.buffer (REE-visible) for returning obj_handle.', 'Binding: source parameter is &obj_handle (TEE-private local) copied into REE-visible buffer.', 'Binding: writes obj_handle into out->memref.buffer (REE-visible) — returns TA handle to REE.', 'Binding callee dest to out->memref.buffer which is caller-provided REE-visible memref', 'Binding callee src to &obj_handle (TA-local handle) passed as source', 'Binding callee len to sizeof(obj_handle) immediate value', "Call-site binding: destination 'out->memref.buffer' aliases caller-provided REE-visible buffer passed as params[2].memref.buffer", "Call-site binding: source '&obj_handle' is TA-local value copied into caller's REE-visible buffer"]

ルール: other

['TEE_MemMove(out->memref.buffer, &obj_handle, sizeof(obj_handle));', 'call-site: TEE_MemMove(out->memref.buffer, &obj_handle, sizeof(obj_handle));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:1528

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'head' parameter aliases caller's attributes pointer; origin (REE-shared template vs TA-owned attributes) is ambiguous.", 'Binding: caller passes obj attrs pointer into get_bool; origin of attributes is TA object storage (TEE-private) though ultimately influenced by REE-driven operations.']

ルール: other

['return get_bool(head, PKCS11_CKA_PRIVATE);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:1538

フェーズ: ['unknown']

詳細: ["callee 'head' parameter aliases obj->attributes from caller (TA-private); provenance affects authorization checks that use returned boolean"]

ルール: other

['return get_bool(head, PKCS11_CKA_MODIFIABLE);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:1588

フェーズ: ['unknown']

詳細: ['get_attribute reads into bbool using size from caller-derived data; caller-provided template/head may come from REE without strong validation']

ルール: weak_input_validation

['if (get_bool(head, PKCS11_CKA_TRUSTED) &&']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:2179

フェーズ: ['unknown']

詳細: ['Call-site binding: head parameter is obj->attributes (TA-private attributes structure) passed from caller']

ルール: other

['return get_bool(obj->attributes, attr->id);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:2414

フェーズ: ['unknown']

詳細: ["Call-site binding: head parameter aliases 'head' built from client-supplied template (originates from REE-provided ctrl buffer)", "Call-site binding: first arg 'head' here aliases head built from template that originated from REE-supplied ctrl buffer"]

ルール: other

['if (cli_ref.id == PKCS11_CKA_TOKEN && get_bool(head, PKCS11_CKA_TOKEN))', 'if (cli_ref.id == PKCS11_CKA_TOKEN && get_bool(head, PKCS11_CKA_TOKEN)) {']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:2423

フェーズ: ['unknown']

詳細: ['Call-site binding: first call reads parent_priv from obj->attributes (TA-private)']

ルール: other

['bool parent_priv = get_bool(obj->attributes, cli_ref.id);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/object.c:2424

フェーズ: ['unknown']

詳細: ['Call-site binding: second call reads obj_priv from head (attributes derived from REE template)']

ルール: other

['bool obj_priv = get_bool(head, cli_ref.id);']

関数: ['TEE_OpenPersistentObject']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:48

フェーズ: ['unknown']

詳細: ['Uses file name derived from token to open persistent object (TEE_OpenPersistentObject); persistent destination protection and filename contents not proven.', 'Uses filename derived from token to open persistent object; persistent destination protection and filename contents not fully proven.', 'Uses token-derived filename buffer to open a persistent object; filename may be influenced by token state which can reflect REE-controlled inputs.', 'Opens persistent object using filename buffer; if filename is attacker-influenced, this affects which persistent object is accessed/created.', 'Opens/creates persistent object using TA-derived file name; structural interaction with persistent storage.', 'TEE_OpenPersistentObject may write persistent-object handle into caller-provided out_hdl which aliases caller storage (db_hdl)', "TEE_OpenPersistentObject is invoked with local 'file' buffer produced from token; filename derives from token and is used to open persistent storage.", 'Filename computed by snprintf is used to open a persistent object; filename provenance is influenced by token/session originating from REE-derived handle.']

ルール: other

['return TEE_OpenPersistentObject(TEE_STORAGE_PRIVATE, file, sizeof(file), TEE_DATA_FLAG_ACCESS_READ | TEE_DATA_FLAG_ACCESS_WRITE, out_hdl);', 'return TEE_OpenPersistentObject(TEE_STORAGE_PRIVATE, file, sizeof(file), ..., out_hdl);', 'TEE_OpenPersistentObject(TEE_STORAGE_PRIVATE, file, sizeof(file), ..., out_hdl);', 'return TEE_OpenPersistentObject(TEE_STORAGE_PRIVATE, file, sizeof(file), ... , out_hdl);']

関数: ['TEE_WriteObjectData', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:64

フェーズ: ['unknown']

詳細: ['Writes TA-held token->db_main into persistent storage via TEE_WriteObjectData; persistent destination region and protection are not proven here.', 'Writes TA-held token->db_main into persistent storage via TEE_WriteObjectData; persistent destination protection is not proven here.', 'TEE_WriteObjectData writes token->db_main (which may include REE-derived credential hashes) to persistent storage; recorded as TEE-private persistent write of sensitive data.', 'Writes token->db_main (contains PIN hashes/flags) to persistent storage via TEE_WriteObjectData; sensitive credential material persisted.', 'Writes token->db_main (contains PIN hashes/flags) to persistent storage; sensitive credential material is persisted.', 'Writes token->db_main (contains PIN-related fields) to persistent storage via TEE_WriteObjectData; sensitive credential material may be persisted.', 'Writes token->db_main (contains PIN-related fields) to persistent storage; sensitive credential material may be persisted.', 'Writes the token->db_main structure to persistent storage via TEE_WriteObjectData; persisted data contains credential-related fields (PIN counters/hashes).', 'Writes TA-private persistent DB (may include credential-related fields) to persistent storage handle.', 'Writes TA-private token->db_main structure into a persistent TEE object via TEE_WriteObjectData; data includes sensitive token state.', 'Writes TA-private token state into persistent TEE object; structural sensitive persistence.', 'Call-site binding: db_hdl is an object handle created locally (open_db_file) passed into TEE_WriteObjectData; origin is TA-managed handle.', 'Call-site binding: buf argument token->db_main is TA memory (but influenced by earlier REE-derived token_id); alias of TA structure passed to write API.', 'Writes TA-held token database structure to persistent storage via TEE_WriteObjectData; destination protection/visibility not proven here.', 'Buffer argument token->db_main (may include credential hashes derived from REE PIN) is passed into write API; binding of caller-owned data recorded.', 'TEE_WriteObjectData persists token->db_main which contains credential hashes derived from REE PIN; recorded as TEE-private persistent write of sensitive data.', "Call-site binding: 'db_hdl' is produced by open_db_file and passed into TEE_WriteObjectData; origin is TEE object handle used for persistent storage.", 'Writes token->db_main (contains PIN hashes/flags) from TA memory into persistent object via TEE_WriteObjectData; sensitive credential material persisted.', 'Persists token->db_main (contains PIN hashes and flags) to persistent storage; sensitive credential material is being written.', 'Persists token->db_main (contains PIN/hash/counters) to storage via TEE_WriteObjectData; sensitive credential material is written to persistent storage.', "Call-site binding: data pointer 'token->db_main' originates from TA token state (contains PIN-related fields) passed into writer.", 'Persists token->db_main (contains PIN/hash/counters) to persistent storage; sensitive credential material is written within TEE.', 'Call-site binding: data buffer argument originates from token->db_main (credential-related structure) and is written to persistent storage.', 'Call-site binding: db_hdl originates from open_db_file(token,&db_hdl) and is used as destination handle for write; origin tied to token persistent storage.', 'Write operation persists credential-related fields (PIN counters/hashes); persisting sensitive state to storage.', 'Writes credential-related token->db_main to persistent storage; sensitive TA state persisted even though not exposed to REE here.', "Call-site binding: buffer 'token->db_main' (TA-private persistent DB state, may contain credential fields) passed into TEE_WriteObjectData for persistence.", "Call-site binding: 'db_hdl' is handle returned by open_db_file (TEE object handle, TA-private origin).", "Call-site binding: 'token->db_main' buffer (TA-private) written into persistent object; contains sensitive token state.", 'Writes TA-private token->db_main into persistent TEE object; contains sensitive token state but remains in TEE storage.']

ルール: other

['res = TEE_WriteObjectData(db_hdl, token->db_main, sizeof(*token->db_main));', 'TEE_WriteObjectData(db_hdl, token->db_main, sizeof(*token->db_main));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:105

フェーズ: ['unknown']

詳細: ["Call-site binding: local variable 's' (TA-private) passed as buffer to TEE_GenerateRandom; RNG output written into TA storage.", 'Address of local s (TEE-private stack) is passed as destination to TEE_GenerateRandom; random written into TEE-private variable.', 'Call-site binding: destination &s is TA-local storage (TEE-private) receiving generated randomness (random considered non-sensitive by default).']

ルール: other

['TEE_GenerateRandom(&s, sizeof(s));']

関数: ['TEE_GenerateRandom']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:314

フェーズ: ['unknown']

詳細: ['Allocates obj->uuid via TEE_Malloc and fills with TEE_GenerateRandom; randomness treated public by default but uuid uniqueness loop queries persistent store.']

ルール: other

['TEE_GenerateRandom(obj->uuid, sizeof(TEE_UUID));']

関数: ['=', 'TEE_GenerateRandom']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:322

フェーズ: ['unknown']

詳細: ['Call-site binding: obj->uuid (persistent object field, TA-private) passed as buffer to TEE_GenerateRandom; RNG fills UUID in-place.', 'obj->uuid (TEE-private object field) is used as destination for random bytes to generate a UUID; binding of destination recorded.', 'Call-site binding: destination obj->uuid is TA-managed persistent object field (TEE-private) filled with randomness for UUID; origin is TA-private.', "Fills obj->uuid (TEE_Malloc'd) with random bytes; randomness treated non-sensitive by default though used as persistent object identifier.", "Binding: obj->uuid (allocated in TA) passed as buffer argument to TEE_GenerateRandom; origin is TEE_Malloc'd memory in TA.", 'Generates random bytes directly into obj->uuid (TA-allocated buffer); buffer originates from TEE_Malloc and is TA-private but derived object may be later persisted or exposed.']

ルール: other

['TEE_GenerateRandom(obj->uuid, sizeof(TEE_UUID));']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:371

フェーズ: ['unknown']

詳細: ['Allocation size for ptr derived from token->db_objs->count; if count is inconsistent this may lead to incorrect sizing for subsequent copies.']

ルール: other

['ptr = TEE_Malloc(sizeof(struct token_persistent_objs) + ((token->db_objs->count - 1) * sizeof(TEE_UUID)), ...);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:388

フェーズ: ['unknown']

詳細: ['Uses idx (from get_persistent_obj_idx) to compute copy lengths and offsets for TEE_MemMove/array shifts; if idx arithmetic is wrong it may miscompute sizes.', 'Uses idx from get_persistent_obj_idx to compute copy lengths and offsets for TEE_MemMove; incorrect idx arithmetic could miscompute sizes.', 'Copies persistent DB header and first part of UUID array into a freshly allocated buffer using a size derived from idx; idx is validated but buffer arithmetic should be reviewed', 'Copies token->db_objs into locally allocated ptr based on idx-derived length; index and sizes depend on token->db_objs contents.', 'Copies token->db_objs into local ptr using idx-derived length; sizes depend on token->db_objs contents.', 'TEE_MemMove copies token->db_objs into newly allocated ptr using idx derived from get_persistent_obj_idx(token, uuid); idx influenced by uuid which originated from earlier REE-driven handle parsing.', 'Copies DB metadata influenced by idx derived from uuid parsed earlier (provenance from REE-derived handle).', "Binding: destination argument 'ptr' is TA-allocated buffer (TEE_Malloc) passed as dest.", "Binding: source argument 'token->db_objs' is TA-owned database structure passed as src.", 'Length depends on idx (from get_persistent_obj_idx) and token->db_objs->count; arithmetic may miscompute copy length if counts/idx inconsistent.', 'Initial TEE_MemMove uses idx-derived length; arithmetic assumptions on counts may be incorrect without explicit bounds at the call.', 'Copies from token->db_objs (persistent DB) into freshly allocated ptr using idx-derived length; source is TA-managed persistent data but index and size depend on token->db_objs->count', 'Allocation and copy lengths depend on token->db_objs->count and idx; if metadata is corrupted elsewhere this could lead to incorrect sizing.', 'Copies token->db_objs into newly allocated ptr using idx-derived length; sizes depend on token->db_objs contents.', 'Copy from token->db_objs into freshly allocated ptr using idx-derived length; source and destination are TA-managed persistent structures.', "Destination 'ptr' is allocated from TEE_Malloc and then written from token->db_objs; copy length depends on idx derived from uuid (REE-influenced handle).", "Binding dst parameter 'ptr' to caller allocation (TEE_Malloc) at call-site; origin is TEE-private.", "Binding src parameter 'token->db_objs' (TEE-private) to callee src; contains persistent DB entries.", 'TEE_MemMove copies DB entries into newly allocated ptr using idx derived from uuid parsed earlier; provenance of uuid is REE-influenced upstream.']

ルール: weak_input_validation, other

['TEE_MemMove(ptr, token->db_objs, sizeof(struct token_persistent_objs) + idx * sizeof(TEE_UUID));', 'TEE_MemMove(ptr, token->db_objs, ...);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:395

フェーズ: ['unknown']

詳細: ['Shifts UUID array tail into new buffer based on computed count; index-derived sizes are data-dependent.', 'TEE_MemMove shifts trailing UUIDs using count derived from ptr->count - idx; count is computed from ptr->count which depends on token->db_objs->count read earlier.', 'Shifts trailing UUIDs based on computed count; sizes depend on token->db_objs->count.', "Binding: destination &ptr->uuids[idx] is region inside TA-allocated 'ptr'.", 'Binding: source &token->db_objs->uuids[idx + 1] is TA-owned array element used as src.', "Copy length 'count * sizeof(TEE_UUID)' derived from ptr->count - idx; if arithmetic under/overflows, copy may be out-of-bounds.", "Shift-copy of UUID array uses 'count' derived from ptr->count - idx; missing explicit bounds check at call site.", 'Shifts tail UUIDs within ptr using count computed from ptr->count - idx; length depends on ptr->count and idx validated earlier', 'Moves tail UUIDs within persistent lists using count-derived length; count depends on ptr->count and idx.', 'Copy length computed from ptr->count and idx; while upstream checks make it safe, absence of an immediate explicit count>=0 check is a structural risk.', 'Shifts trailing UUIDs within ptr from token->db_objs; indices and count drive the copy length (derived from TA data).', 'Shifts trailing UUIDs using count computed from ptr->count and idx; count derived from token->db_objs->count read earlier.', "Binding dst parameter '&ptr->uuids[idx]' to allocated ptr region; destination is TEE-private and index idx is REE-influenced.", "Binding src parameter '&token->db_objs->uuids[idx + 1]' to token DB region; source is TEE-private."]

ルール: other, weak_input_validation

['TEE_MemMove(&ptr->uuids[idx], &token->db_objs->uuids[idx + 1], count * sizeof(TEE_UUID));', 'TEE_MemMove(&ptr->uuids[idx], &token->db_objs->uuids[idx + 1], ...);']

関数: ['TEE_WriteObjectData', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:399

フェーズ: ['unknown']

詳細: ['TEE_WriteObjectData writes updated ptr to persistent storage; data derived from token->db_objs with sizes computed from ptr->count.', 'Writes updated DB contents to persistent storage; data derived from token->db_objs and influenced by earlier REE-provided handle selection.', "Pointer 'ptr' passed as buffer to write API; origin may include persistent object list derived from TA data, binding recorded.", 'Persists object list structure (ptr) to storage; written blob size depends on ptr->count which may reflect TA state influenced by REE inputs.', "Call-site binding: 'ptr' data pointer aliases TA-managed persistent objects structure passed into writer.", "Call-site binding: buffer 'ptr' (token persistent objects blob) passed to TEE_WriteObjectData to store objects metadata persistently.", "Call-site binding: 'db_hdl' is TEE object handle used for write (TEE-private origin).", "Call-site binding: 'ptr' buffer (TA-private persistent objs) is written to storage; size derived from ptr->count."]

ルール: other

['res = TEE_WriteObjectData(db_hdl, ptr, sizeof(struct token_persistent_objs) + ptr->count * sizeof(TEE_UUID));', 'TEE_WriteObjectData(db_hdl, ptr, sizeof(struct token_persistent_objs) + ptr->count * sizeof(TEE_UUID));']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:435

フェーズ: ['unknown']

詳細: ['Copies provided uuid into token->db_objs (persistent index) via TEE_MemMove; source uuid provenance uncertain (may be REE-derived)', 'Copies uuid into token persistent index; uuid provenance may be REE-influenced', 'Copies UUID into token->db_objs array via TEE_MemMove/implicit move; destination is token-managed storage grown by TEE_Realloc', 'Copies UUID into token->db_objs array via TEE_MemMove/implicit move; destination is token-managed storage grown by TEE_Realloc.', 'Binding: destination token->db_objs->uuids + count is TA-managed array location used as dest.', "Binding: source 'uuid' is local/stack or caller-supplied UUID used as src.", 'Inserts uuid into token->db_objs by copying caller-provided uuid into db array; destination is TA-managed persistent array and source may be external/internal uuid', 'Copies uuid into token->db_objs array slot; origin of uuid may be internal but binding persists into persistent array.', 'Copies provided uuid into token->db_objs->uuids area; destination is TA-managed persistent DB memory updated from local uuid.', 'Inserts uuid into token->db_objs; destination is token->db_objs and source is uuid local buffer.', "Binding dst parameter 'token->db_objs->uuids + count' to token DB storage (TEE-private).", "Binding src parameter 'uuid' (local buffer) to callee; uuid may be populated from disk earlier and used to create objects.", 'Destination buffer token->db_objs->uuids+count is TEE-managed memory (realloc result) receiving copied uuid; destination provenance is TEE-private but allocation was recent', 'Source uuid passed into TEE_MemMove may originate from obj->uuid (potentially derived from REE-supplied attributes), provenance uncertain', 'The move call writes potentially untrusted uuid bytes into the token index before persisting; persisting later may store REE-derived data', 'Copies uuid (provenance uncertain, may be derived from REE-supplied template) into token->db_objs index prior to persistence; this persists potentially untrusted data.', "Binding call-site dest parameter to token->db_objs->uuids + count (storage just realloc'd); dest originates from TA-managed token storage", "Binding call-site src parameter to 'uuid' (caller-provided/generated UUID)", 'Copies UUID into token->db_objs array; growth and indexing depend on count derived from persistent state — bounds should be validated.']

ルール: other

['TEE_MemMove(token->db_objs->uuids + count, uuid, sizeof(TEE_UUID));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:445

フェーズ: ['unknown']

詳細: ['db handle returned by open_db_file is passed to TEE_TruncateObjectData; handle provenance is TA-private but call truncates persistent storage making provenance a structural risk', 'Binding of callee handle parameter to caller-local db_hdl obtained from open_db_file; handle is TA-managed object handle', 'Binding of callee length parameter to computed size expression derived from token structures (caller-controlled counts); length influences truncate extent']

ルール: other

['res = TEE_TruncateObjectData(db_hdl, size + sizeof(TEE_UUID));']

関数: ['TEE_WriteObjectData', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:456

フェーズ: ['unknown']

詳細: ['Writes token->db_objs (including uuids array) to persistent storage via TEE_WriteObjectData; this persists data that may have originated outside TEE', 'Persists token->db_objs (including uuids) to storage; data may originate outside TEE', 'token->db_objs passed into write API (contains object UUIDs); binding of TA-private structure recorded.', 'Writes token->db_objs (object listing with UUIDs) to persistent storage; TA-private metadata persisted.', "Call-site binding: 'token->db_objs' pointer passed to writer aliases TA-managed structure.", "Call-site binding: buffer 'token->db_objs' (TA-private object list including UUIDs) written persistently via TEE_WriteObjectData.", "Call-site binding: 'db_hdl' object handle used for write (TEE-private origin).", "Call-site binding: 'token->db_objs' buffer (TA-private) written; size depends on token->db_objs->count.", 'Persists token->db_objs (including uuids array) to storage; persisted data may include bytes originating from untrusted input.', 'Writes token->db_objs (including uuids array) to persistent storage; this persists data that may have originated outside TEE']

ルール: other

['res = TEE_WriteObjectData(db_hdl, token->db_objs, sizeof(struct token_persistent_objs) + token->db_objs->count * sizeof(TEE_UUID));', 'TEE_WriteObjectData(db_hdl, token->db_objs, sizeof(struct token_persistent_objs) + token->db_objs->count * sizeof(TEE_UUID));']

関数: ['TEE_WriteObjectData']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:561

フェーズ: ['unknown']

詳細: ['size computed from obj->attributes->attrs_size (potentially attacker-controlled) is used to write/truncate persistent storage without further validation']

ルール: weak_input_validation

['size = sizeof(struct obj_attrs) + obj->attributes->attrs_size; res = TEE_WriteObjectData(hdl, obj->attributes, size);']

関数: ['=', 'TEE_WriteObjectData']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:563

フェーズ: ['unknown']

詳細: ['obj->attributes (attributes blob) passed into write API; may include sensitive attributes derived from REE PINs, binding recorded.', 'Writes object attributes (obj->attributes) of size based on attrs_size to storage; persisted attribute blobs may contain sensitive metadata.', "Call-site binding: 'obj->attributes' pointer passed to writer aliases TA object attributes memory.", "Call-site binding: buffer 'obj->attributes' (object attributes, may include sensitive attributes) written to storage via TEE_WriteObjectData.", "Call-site binding: 'hdl' is a TEE object handle (TEE-private) used for write.", "Call-site binding: 'obj->attributes' buffer (TA-private) written to object; size from obj->attributes->attrs_size.", 'Writes obj->attributes to persistent storage using size computed from obj->attributes->attrs_size which may be influenced by earlier REE-derived template; size not strongly validated before write', 'size computed from obj->attributes->attrs_size (potentially attacker-controlled) is used to write persistent storage without further validation']

ルール: other, weak_input_validation

['res = TEE_WriteObjectData(hdl, obj->attributes, size);', 'TEE_WriteObjectData(hdl, obj->attributes, size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:567

フェーズ: ['unknown']

詳細: ['size derived from obj->attributes->attrs_size (potentially attacker-influenced) is passed to TEE_TruncateObjectData without additional validation']

ルール: weak_input_validation

['res = TEE_TruncateObjectData(hdl, size);']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:640

フェーズ: ['unknown']

詳細: ["Binding: destination 'uuid' is local variable receiving data read from db_objs.", 'Copies sizeof(*uuid) from &db_objs->uuids[idx] with idx validated earlier but without redundant bounds check at this call site.', 'Copies UUID from db_objs into local uuid buffer for object creation; destination uuid buffer provenance depends on caller and is used to create object', 'Copies UUID from db_objs into local uuid buffer; reads persistent array into caller-provided uuid pointer.', 'Reads UUID from persistent DB into local uuid buffer; source is token DB object area (TA-private).', 'Reads uuid from db_objs into uuid local variable; copy length sizeof(*uuid).', "Binding dst parameter 'uuid' (local output buffer) to callee; used subsequently to create token object.", "Binding src parameter '&db_objs->uuids[idx]' to callee; source is token DB region read from disk earlier.", "Binding call-site dest parameter to local 'uuid' buffer (target for read from persistent list)", 'Binding call-site src parameter to &db_objs->uuids[idx] (persistent array element)']

ルール: other, weak_input_validation

['TEE_MemMove(uuid, &db_objs->uuids[idx], sizeof(*uuid));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:682

フェーズ: ['unknown']

詳細: ['computed size (sizeof(*db_main)+sizeof(*db_objs)) used to truncate persistent DB object; size provenance should be validated']

ルール: weak_input_validation

['res = TEE_TruncateObjectData(db_hdl, sizeof(*db_main) + sizeof(*db_objs));']

関数: ['=', 'TEE_WriteObjectData']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c:693

フェーズ: ['unknown']

詳細: ['db_objs structure passed into write API to persist empty list; binding recorded for persistent update.', 'Writes db_objs (possibly empty) to persistent storage; finalizing persistent state via writer.', "Call-site binding: 'db_objs' pointer passed to writer aliases TA-managed persistent object header.", "Call-site binding: buffer 'db_objs' (empty/reset object list) persisted via TEE_WriteObjectData after initialization.", "Call-site binding: 'db_hdl' handle used for final write (TEE-private origin).", "Call-site binding: 'db_objs' buffer (TA-private) written to persistent storage; contains persistent object metadata.", 'Writes db_objs (TA-local DB structure) to persistent storage; binding of db_objs pointer passed into write']

ルール: other

['res = TEE_WriteObjectData(db_hdl, db_objs, sizeof(*db_objs));', 'TEE_WriteObjectData(db_hdl, db_objs, sizeof(*db_objs));']

関数: ['=', 'snprintf']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c (call site):30

フェーズ: ['unknown']

詳細: ['name buffer (caller-provided stack array) is passed as destination to snprintf; alias of caller buffer into formatting function.', "Formatting output via snprintf writes into caller buffer 'name'; output size depends on get_token_id(token) formatting and size parameter."]

ルール: other

['int n = snprintf(name, size, "token.db.%u", get_token_id(token));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c (call site):44

フェーズ: ['unknown']

詳細: ['token (caller-provided) passed into get_db_file_name; alias of caller token structure into helper.', "file buffer (caller stack array) passed as 'name' into get_db_file_name; alias of local buffer into helper."]

ルール: other

['res = get_db_file_name(token, file, sizeof(file));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c (call site):377

フェーズ: ['unknown']

詳細: ['token (caller-provided) passed into open_db_file; alias of caller token structure into helper.', '&db_hdl (address of local handle) passed as out_hdl into open_db_file; binding of caller stack slot into helper.']

ルール: other

['res = open_db_file(token, &db_hdl);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c (call site):441

フェーズ: ['unknown']

詳細: ['token (caller-provided) passed into open_db_file; alias of caller token structure into helper.', '&db_hdl (address of local handle) passed as out_hdl into open_db_file; binding of caller stack slot into helper.']

ルール: other

['res = open_db_file(token, &db_hdl);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c (call site):598

フェーズ: ['unknown']

詳細: ['token (caller-provided) passed into open_db_file; alias of caller token structure into helper.', '&db_hdl (address of local handle) passed as out_hdl into open_db_file; binding of caller stack slot into helper.']

ルール: other

['res = open_db_file(token, &db_hdl);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/persistent_token.c (call site):662

フェーズ: ['unknown']

詳細: ['token (caller-provided) passed into get_db_file_name; alias of caller token structure into helper.', "file buffer (caller stack array) passed as 'name' into get_db_file_name; alias of local buffer into helper."]

ルール: other

['res = get_db_file_name(token, file, sizeof(file));']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:220

フェーズ: ['unknown']

詳細: ['Reads attribute header from untrusted cur and uses cli_head.size to advance parsing loop without stronger validation.']

ルール: weak_input_validation

['TEE_MemMove(&cli_head, cur, sizeof(cli_head));']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:352

フェーズ: ['unknown']

詳細: ['Copies data from cur using pkcs11_ref.size (untrusted) even though bounded by MIN(), reliance on parsed size may be risky.']

ルール: weak_input_validation

['TEE_MemMove(&data[0], cur + sizeof(pkcs11_ref), MIN(pkcs11_ref.size, sizeof(data)));']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:1554

フェーズ: ['unknown']

詳細: ['Uses get_class(head) and object_is_private(head) on provided head without explicit null/structure integrity checks beyond switch default']

ルール: weak_input_validation

['switch (get_class(head)) { ... private = object_is_private(head); }']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:1566

フェーズ: ['unknown']

詳細: ['Access decision uses session predicates where session is influenced by REE-provided data; untrusted session provenance may affect auth checks.']

ルール: weak_input_validation

['if (private && (pkcs11_session_is_public(session) || pkcs11_session_is_so(session)))']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:1669

フェーズ: ['unknown']

詳細: ['Asserts that key type matches expected value using get_key_type(head) where head is derived from untrusted templates; malformed attrs could lead to incorrect behavior', 'Asserts key-type via get_key_type(head) where head is derived from untrusted templates; malformed attrs could disrupt processing.']

ルール: weak_input_validation

['assert(get_key_type(head) == PKCS11_CKK_EC);']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:1885

フェーズ: ['unknown']

詳細: ['Parses allowed mechanism list from attributes and compares entries to proc_id (caller-controlled) using TEE_MemMove; relies on attribute contents and size from get_attribute_ptr without strong validation.']

ルール: weak_input_validation

['for (count = size / sizeof(uint32_t); count; count--) { TEE_MemMove(&proc, attr, sizeof(uint32_t)); attr += sizeof(uint32_t); if (proc == proc_id) return true; }']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:1886

フェーズ: ['unknown']

詳細: ['Copies 4-byte words from attr buffer (attribute blob) into local proc using length derived from attribute size; relies on attribute contents and size with limited validation.', 'Copies 4-byte words from attribute buffer into local variable using size-derived loop count; relies on attribute blob size/content correctness.']

ルール: weak_input_validation

['TEE_MemMove(&proc, attr, sizeof(uint32_t));']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2178

フェーズ: ['unknown']

詳細: ['uses obj->attributes and attr->id to decide modifiability (get_bool), relying on object state without additional validation of attr contents', 'Uses attr->id (from untrusted input) to index into obj->attributes via get_bool without validating that id maps to a valid stored attribute']

ルール: other, weak_input_validation

['return get_bool(obj->attributes, attr->id);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2236

フェーズ: ['unknown']

詳細: ['uses attr->id (from REE-derived req_attr) to index get_bool(obj->attributes, attr->id) without additional bounds checks on id', 'Uses untrusted attr->id (from parsed REE data) to decide modifiability and may call get_bool with that id without additional validation']

ルール: weak_input_validation

['case PKCS11_CKA_EXTRACTABLE: return get_bool(obj->attributes, attr->id);']

関数: ['=', 'unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2311

フェーズ: ['unknown']

詳細: ['alias of caller-provided req_attr (derived from REE-supplied head) used directly to switch on id', 'Decision logic uses req_attr->id (from untrusted parsed data) to control allowances; id-driven branches may allow changes without validating attribute payload/size', 'Decision logic branches directly on req_attr->id from untrusted parsed data; attribute payload/size not re-validated before allowing modifications.']

ルール: other, weak_input_validation

['switch (req_attr->id) {', 'switch (req_attr->id) { ... }']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2380

フェーズ: ['unknown']

詳細: ['reads attribute header from cur (derived from head which is REE-supplied) and uses cli_ref.size to advance len without fully validating that sizeof(cli_ref)+cli_ref.size stays within end', "Parses client-supplied attribute entries from 'head' (derived from caller) with len computed from untrusted cli_ref.size; loop uses cur < end but cli_ref.size not validated against remaining bytes", 'Parses client-supplied attribute entries into cli_ref using TEE_MemMove without validating cli_ref.size against remaining bytes.', 'Parses client-supplied attribute entries and copies header without validating cli_ref.size against remaining buffer before using it as a bound.', 'Reads attribute header from cur (derived from head which is REE-supplied) and uses cli_ref.size to advance len without fully validating that sizeof(cli_ref)+cli_ref.size stays within end', 'Parses client-supplied attribute headers using cli_ref.size from untrusted buffer without validating that cli_ref.size fits remaining bytes.', 'reads attribute header from REE-derived blob and uses cli_ref.size to advance parsing without fully validating total length', 'Parses client-supplied attribute entries using cli_ref.size without validating it against remaining bytes before using it to advance the cursor.', 'reads attribute header from cur (derived from head which is REE-supplied) and uses cli_ref.size to advance len without fully validating bounds against end', 'Parses client-supplied attribute headers from head buffer using cli_ref.size without explicit validation against remaining bytes before using cli_ref.size-controlled lengths.', "Copies a cli_ref struct from 'cur' pointer into local structure without explicit bounds on cur's provenance/remaining buffer length.", 'Copies a cli_ref struct from buffer without explicit provenance/remaining-length validation of source.', 'destination is &cli_ref (local TA stack/TEE-private) bound to callee dst parameter', "source pointer 'cur' is derived from head (attributes list) which originates from REE-visible memory", 'reads header via TEE_MemMove from cur (derived from REE) and then uses cli_ref.size to compute len without proving sizeof(cli_ref)+cli_ref.size <= end', "Call-site binding: destination '&cli_ref' is a TA-local stack object (TEE-private)", "Source 'cur' points into attributes built from caller data; copying sizeof(cli_ref) before validating cli_ref.size may allow parsing of malformed/short input"]

ルール: weak_input_validation, other

['TEE_MemMove(&cli_ref, cur, sizeof(cli_ref)); len = sizeof(cli_ref) + cli_ref.size;', 'TEE_MemMove(&cli_ref, cur, sizeof(cli_ref));']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2381

フェーズ: ['unknown']

詳細: ['len computed from cli_ref.size (tainted) is used to advance cur; if cli_ref.size is large or causes overflow, loop arithmetic may go out-of-bounds.', 'cli_ref.size (from untrusted buffer) is used to compute len for advancing cur without validation against remaining bytes, enabling parsing errors or out-of-bounds advances.']

ルール: weak_input_validation

['len = sizeof(cli_ref) + cli_ref.size;']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2662

フェーズ: ['unknown']

詳細: ["Copies attribute value (likely TA-private secret) into freshly TEE_Malloc'd buffer using *sz; source sensitivity is secret and buffer is TA-private.", 'Copies attribute VALUE into allocated buffer using size from get_attribute_ptr without additional validation; upstream header corruption could influence size.', 'Copies *sz bytes from value into buffer; origin/provenance of value and buffer sizes unclear, risk of overwriting shared memory if buffer is REE-visible.', 'Copies *sz bytes from value into buffer; provenance and sizes unclear, potential overwrite if buffer is REE-visible.', "destination 'buffer' passed to callee; buffer likely TA-allocated (TEE-private) but origin uncertain here", "source 'value' passed into callee; origin not clear in this snippet (could be REE or TA)", "Call-site binding: destination 'buffer' is TA-allocated (likely TEE_Malloc) and thus TA-private", "Call-site binding: source 'value' provenance unclear (could be REE-provided or TA-owned); origin not validated here", 'Call-site binding: callee first parameter (dest) is buffer allocated by TEE_Malloc in this function (TA-private).', 'Call-site binding: callee second parameter (src) aliases attribute value from head (TA-private secret).', 'Call-site binding: callee third parameter (size) is *sz derived from attribute length (TA-controlled).', 'Copies attribute value (likely secret) into newly allocated TEE-private buffer using *sz; sensitive data flows within TA and is later used for wrapping.']

ルール: other

['TEE_MemMove(buffer, value, *sz);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2736

フェーズ: ['unknown']

詳細: ['Allocates buffer with TEE_Malloc to hold sensitive private-key DER; returns it via *data/*sz making TA-private secret available to caller.']

ルール: other

['buffer = TEE_Malloc(der_size, ...); *data = buffer; *sz = mbedtls_rc;']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2737

フェーズ: ['unknown']

詳細: ['Allocates TA-private buffer to hold sensitive private-key DER and returns it via out parameters; sensitive data becomes available to caller context.']

ルール: other

['buffer = TEE_Malloc(der_size, ...); *data = buffer; *sz = mbedtls_rc;']

関数: ['=', 'mbedtls_pk_write_key_der']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2743

フェーズ: ['unknown']

詳細: ["Call-site binding: callee 'pk' parameter is local mbedtls_pk_context (TA-private) used to produce DER key bytes.", "Call-site binding: callee 'buffer' parameter is TA-allocated buffer (TEE_Malloc) and will receive private-key DER bytes.", "Call-site binding: callee 'der_size' parameter is caller-provided allocation size (der_size) controlling how many bytes may be written.", 'Writes private-key DER into TA-private buffer; sensitive data produced and returned to caller via *data/*sz in caller.']

ルール: other

['mbedtls_rc = mbedtls_pk_write_key_der(&pk, buffer, der_size);']

関数: ['array_write']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2750

フェーズ: ['unknown']

詳細: ['Per-byte in-place copy loop moves DER bytes to front of buffer and zeroes tail; operates on TA-private buffer containing secret—ensure loop bounds match mbedtls_rc.', 'Per-byte in-place copy moves DER bytes to front of buffer and zeroes tail; ensure loop bounds match mbedtls_rc to avoid buffer issues.', 'Per-byte loop moves DER bytes to buffer front and zeroes tail; requires correct bounds (mbedtls_rc vs der_size).']

ルール: other

['for (i = 0; i < mbedtls_rc; i++) { buffer[i] = buffer[i + start]; buffer[i + start] = 0; }']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2772

フェーズ: ['unknown']

詳細: ['Produces key_data/key_sz from key attributes (secret material) which will later be used for wrapping; sensitive TA-private data is allocated/encoded here.']

ルール: other

['rc = alloc_copy_attribute_value(head, data, sz) / rc = encode_rsa_private_key_der(head, data, sz);']

関数: ['set_attribute']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_attributes.c:2825

フェーズ: ['unknown']

詳細: ['set_attribute called with id pointer and id_size obtained from get_attribute_ptr without additional validation of provenance or size limits', 'set_attribute invoked with id pointer and id_size from get_attribute_ptr without stronger validation', 'set_attribute called with id pointer and id_size obtained from get_attribute_ptr without additional validation of provenance or size limits.', 'set_attribute called with id pointer/size from get_attribute_ptr without validating provenance or reasonable size limits']

ルール: weak_input_validation

['return set_attribute(priv_head, PKCS11_CKA_ID, id1, id1_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:59

フェーズ: ['unknown']

詳細: ["Call-site binding: 'out_hdl' (caller-provided address) is written by open_db_file via TEE_OpenPersistentObject; origin is caller-local handle."]

ルール: other

['res = TEE_OpenPersistentObject(TEE_STORAGE_PRIVATE, file, sizeof(file), TEE_DATA_FLAG_ACCESS_READ | TEE_DATA_FLAG_ACCESS_WRITE, out_hdl);']

関数: ['TEE_WriteObjectData']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:64

フェーズ: ['unknown']

詳細: ['TEE_WriteObjectData persists token->db_main (may include hashes derived from REE-supplied PIN) to persistent storage.']

ルール: other

['res = TEE_WriteObjectData(db_hdl, token->db_main, sizeof(*token->db_main));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:170

フェーズ: ['unknown']

詳細: ['Call-site binding: callee params pointer aliases caller-provided params (REE-visible) allowing REE-controlled memrefs into the function.', 'Call-site binding: callee params pointer aliases caller-provided params (REE-visible).']

ルール: other

['rc = entry_ck_token_mecha_ids(ptypes, params);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:190

フェーズ: ['unknown']

詳細: ['Call-site binding: params (caller-provided memref buffer) aliased into callee parameter (ctrl) — shared REE buffer passed to TA.']

ルール: other

['rc = entry_ck_token_initialize(ptypes, params);']

関数: ['=', 'TEE_MemFill']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:283

フェーズ: ['unknown']

詳細: ["Binding: callee will write into buffer derived from caller-provided pointer 'str' (alias of info field in caller).", 'Per-byte fill into buffer at offset n; n derived from str content but bounded by size via strnlen.', 'Destination pointer is caller-derived (str + n); TEE_MemFill writes len bytes at that alias of caller buffer.', 'fills bytes at str + n for length (size - n) using TEE_MemFill; write target depends on caller-provided pointer/size', 'alias of caller-provided buffer (str) passed derived (str + n) into TEE_MemFill; write target originates from caller', 'fills len bytes at destination (dst) using caller-controlled size - n; write depends on caller pointer/size']

ルール: other

["TEE_MemFill(str + n, ' ', size - n);"]

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:293

フェーズ: ['unknown']

詳細: ['Caller passes address of local dev_id into TEE_GetPropertyAsUUID (alias of TA-private buffer bound to callee parameter).', 'Property name string literal passed to TEE API (binding of callee parameter to a TA-resident const string).']

ルール: other

['res = TEE_GetPropertyAsUUID(TEE_PROPSET_TEE_IMPLEMENTATION, "gpd.tee.deviceID", &dev_id);', '"gpd.tee.deviceID"']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:305

フェーズ: ['unknown']

詳細: ['Copies formatted desc into info->slot_description via TEE_MemMove; dest and src are TA-private but ultimately flow to caller buffer later.', 'Copies formatted desc into info->slot_description; although TA-private, this flows later to caller buffer.', 'Copies local formatted desc into info->slot_description (both TA-private) via TEE_MemMove.']

ルール: other

['TEE_MemMove(info->slot_description, desc, n);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:353

フェーズ: ['unknown']

詳細: ['Copies local struct info into caller-provided out->memref.buffer (shared/REE-visible destination).', 'Copies local struct info into caller-provided out->memref.buffer (REE-visible destination).', 'Copies local info struct into caller-provided out->memref.buffer (shared/REE-visible destination).', 'Copies local info struct into caller-provided out->memref.buffer (shared/REE-visible); this is a potential information-disclosure sink to the REE.', 'Destination out->memref.buffer is caller-provided (REE-visible) and is bound to TEE_MemMove dst parameter (alias of shared buffer).', 'Local non-sensitive struct info copied into caller-provided REE-visible buffer (shared buffer alias).']

ルール: other

['TEE_MemMove(out->memref.buffer, &info, out->memref.size);']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:366

フェーズ: ['unknown']

詳細: ['Copies local enum rc into caller-provided memref.buffer (REE-visible); destination is shared/REE-visible though rc is non-sensitive.']

ルール: other

['TEE_MemMove(params[0].memref.buffer, &rc, sizeof(rc));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:377

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' originates from session->token (path earlier) and is passed to open_db_file; influences persistent DB access.", 'Call-site binding: out_hdl is &db_hdl (local) and will receive a persistent object handle from callee.', 'Binding token into open_db_file parameter; token is TA-managed structure.']

ルール: other

['res = open_db_file(token, &db_hdl);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:406

フェーズ: ['unknown']

詳細: ["Destination buffer 'sn' is a TA-local stack buffer (TEE-private) passed to snprintf which writes formatted data there; subsequent memmove copies it into info.serial_number.", 'Format string argument is a constant (TA-private) passed into snprintf; binding noted for pointer argument provenance.']

ルール: other

['n = snprintf(sn, sizeof(sn), "%0*"PRIu32, (int)sizeof(info.serial_number), token_id);']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:411

フェーズ: ['unknown']

詳細: ['Copies sn into info.serial_number (TA-private fields) via TEE_MemMove.', 'Copies into local info.serial_number from sn; src is caller-influenced but destination is TA-private struct field.', "TA-local serial string 'sn' (filled by snprintf) is copied into caller-provided out->memref.buffer; destination is REE-visible though data appears non-sensitive.", 'Copies from local sn into info.serial_number (both TA-local buffers); binding shows both src/dst are TEE-private, so no REE boundary but still a data movement site.']

ルール: other

['TEE_MemMove(info.serial_number, sn, sizeof(info.serial_number));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:414

フェーズ: ['unknown']

詳細: ['Copies token label into info.label (both TA-private) via TEE_MemMove.', 'Copies token label from token DB (TEE-private) into TA-private info.label field; binding of src to callee src parameter.']

ルール: other

['TEE_MemMove(info.label, token->db_main->label, sizeof(info.label));']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:420

フェーズ: ['unknown']

詳細: ['Copies TA-local struct info into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove; destination is shared though info appears non-sensitive.', 'Copies TA-local struct info into caller-provided out->memref.buffer (REE-visible); destination is shared though info appears non-sensitive.', 'Copies local info into caller out->memref.buffer (shared/REE-visible destination).', 'Copies local info into caller-provided out->memref.buffer (alias of shared buffer passed as dst).', 'Copies TA-local struct info into caller-provided out->memref.buffer (REE-visible); binding records shared destination originating from REE params.']

ルール: other

['TEE_MemMove(out->memref.buffer, &info, sizeof(info));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:441

フェーズ: ['unknown']

詳細: ["Call-site binding: 'token' passed may be influenced by earlier REE-provided session state; used to compute DB filename.", 'Call-site binding: out_hdl (&db_hdl) receives object handle; callee controls persistent object access.']

ルール: other

['res = open_db_file(token, &db_hdl);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:488

フェーズ: ['unknown']

詳細: ['TEE_MemMove copies TA-allocated mechanism list into REE-provided out->memref.buffer; out->memref.size earlier used to derive allocation count (attacker-controlled), risking size/alloc validation issues.', 'Copies array (TA-allocated) into caller out->memref.buffer (REE-visible); caller size set just prior.', 'Copies array into caller-provided out->memref.buffer; dst aliases REE-visible buffer passed from caller.', "Call-site binding: destination parameter aliases caller's out->memref.buffer (REE-visible).", "Call-site binding: source parameter aliases TA-allocated 'array' (TEE-private)."]

ルール: weak_input_validation, other

['TEE_MemMove(out->memref.buffer, array, out->memref.size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:501

フェーズ: ['unknown']

詳細: ['Local aliases ctrl and out point into caller params (shared/REE-visible buffers)']

ルール: other

['TEE_Param *ctrl = params; TEE_Param *out = params + 2;']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:538

フェーズ: ['unknown']

詳細: ['Copies TA-constructed info into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove', 'Copies TA-constructed mechanism info into caller-provided out->memref.buffer (REE-visible).', 'Copies local info into caller out buffer (REE-visible) via TEE_MemMove.', 'Copies local info into caller-provided out->memref.buffer (binding dst to shared buffer).', "Call-site binding: destination parameter aliases caller's out->memref.buffer (REE-visible).", "Call-site binding: source parameter is address of TA-local 'info' (TEE-private).", 'Call-site binds callee dest to caller-provided out->memref.buffer (shared/REE-visible) and src to TA-local &info — alias of shared buffer passed into helper', 'Copies TA-constructed info into caller-provided out->memref.buffer (shared/REE-visible); size check enforced but structural aliasing to shared buffer remains a risk if semantics change.']

ルール: other

['TEE_MemMove(out->memref.buffer, &info, sizeof(info));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:678

フェーズ: ['unknown']

詳細: ['Copies session handle into caller out buffer (REE-visible destination).', 'Copies session handle into caller-provided out buffer (dst is REE-visible from caller).', "Call-site binding: destination parameter aliases caller's out->memref.buffer (REE-visible) at session handle return.", 'Call-site binding: source parameter is TA-local session->handle (TEE-private).', 'Call-site binds dest to caller-provided out->memref.buffer (shared/REE-visible) and src to TA session handle — alias of shared buffer passed into helper', 'Copies session->handle (TEE-private) into caller-provided out->memref.buffer (REE-visible), binding callee dest/src to shared/TEE origins.']

ルール: other

['TEE_MemMove(out->memref.buffer, &session->handle, sizeof(session->handle));']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:810

フェーズ: ['unknown']

詳細: ['Copies info into caller out buffer (REE-visible) via TEE_MemMove.', 'Copies local info into caller-provided out->memref.buffer; dst is alias of shared buffer.', "Call-site binding: destination parameter aliases caller's out->memref.buffer (REE-visible) when returning info.", "Call-site binding: source parameter is TA-local 'info' struct (TEE-private).", 'Call-site binds dest to caller-provided out->memref.buffer (shared/REE-visible) and src to TA-local info structure', 'Copies local info (TEE-private) into caller-provided out->memref.buffer (REE-visible), binding callee params to shared/TEE origins.', "Destination is caller-provided memref buffer (REE-visible) while source is TA-private struct 'info'; binding shows TA writing into REE-shared memory.", "Source '&info' is TA-private and is copied into a REE-visible buffer (out->memref.buffer); records binding of callee src parameter to TA-private origin.", "TA-local session info is copied into a REE-visible memref; structurally this is TA->REE data flow which would be sensitive if 'info' contained secrets."]

ルール: other

['TEE_MemMove(out->memref.buffer, &info, sizeof(info));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:943

フェーズ: ['unknown']

詳細: ['Copies label into token->db_main->label (TA-private destination) via TEE_MemMove.', 'Copies caller-provided label into token DB field (dst is TA-private but src is REE-visible); binding src to callee src parameter.', 'Call-site binding: destination parameter aliases TA-local token DB label buffer (TEE-private) being written to by caller before move.', "Call-site binding: source parameter 'label' originates from REE (caller-provided).", "Call-site copies label into token->db_main->label; dest is TA-private while source 'label' provenance is unclear (likely REE-origin), so alias binding recorded", "Copies from 'label' into token->db_main->label; source provenance unclear (could be REE), destination is TEE-private—binding observed.", 'TEE_MemMove copies label into token DB; source provenance unclear (could be REE), so structural risk flagged.', 'Destination token label field is TA-internal (TEE-private); binding records callee dst param aliasing TA storage.', "Source 'label' origin is unclear (could be REE-provided); binding records callee src param origin uncertainty.", 'Binding dest parameter to token->db_main->label (TA-private destination) at call-site; destination is TA storage.', "Binding src parameter to 'label' which was populated from caller-controlled serialargs (REE-origin); input may be attacker-controlled."]

ルール: other, weak_input_validation

['TEE_MemMove(token->db_main->label, label, PKCS11_TOKEN_LABEL_SIZE);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:1659

フェーズ: ['unknown']

詳細: ['Generates random into TA-private buffer then copies into caller-provided out->memref.buffer (REE-visible); random is public by default.', 'Binding of callee buffer parameter to a TA-allocated buffer (TEE_Malloc) at call-site; records origin and that generated bytes (random) are written into this buffer.']

ルール: other

['TEE_GenerateRandom(buffer, count); TEE_MemMove(data, buffer, count);', 'TEE_GenerateRandom(buffer, count);']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/pkcs11_token.c:1660

フェーズ: ['unknown']

詳細: ['Copies random bytes from TA-generated buffer into data (destination region depends on caller); source is TEE-generated random (non-sensitive by default).', 'Moves random bytes (generated by TEE_GenerateRandom) from buffer into data; src is TEE-private random, dst region unclear (binding shown).', "Copies from buffer filled by TEE_GenerateRandom into data; origins ambiguous across call-sites (buffer is TA-generated random, data's region unclear).", "Call-site binding: destination parameter 'data' (TA buffer being filled) is TA-managed (unknown allocation provenance).", "Call-site binding: source parameter 'buffer' was filled by TEE_GenerateRandom (non-sensitive random by default) before the move.", 'Call-site moves random bytes from buffer (generated by TEE_GenerateRandom) into data; both source and dest are TA-private — internal copy recorded', "Copies random bytes from buffer (produced by TEE_GenerateRandom, TEE-private) into 'data' whose provenance is unclear; binding observed and labeled as random.", "Source 'buffer' is filled by TEE_GenerateRandom (TA-private random) then moved; binding records src as TA-private random.", "Destination 'data' region is unclear at this site (could be TA-private or REE-visible); binding records uncertainty which is a structural risk.", "Binding dest parameter to 'data' at call-site; destination region unclear in this context.", "Binding src parameter to 'buffer' filled by TEE_GenerateRandom (TEE-private random source).", 'Copies generated random from TA-private buffer into caller-provided out->memref.buffer (REE-visible); random is public by default but this is a structural disclosure path.', 'Binding of callee dest parameter to caller-provided out->memref.buffer (shared/REE-visible); alias of shared buffer passed into helper.', 'Binding of callee src parameter to TA-allocated buffer (TEE_Malloc) which is TA-private; records origin.', 'Copies TA-generated random bytes from TA-private buffer into caller-provided (REE-visible) buffer via TEE_MemMove.']

ルール: other

['TEE_MemMove(data, buffer, count);', 'TEE_MemMove(data, buffer, count); // dest = data (out->memref.buffer)', 'TEE_MemMove(data, buffer, count); // src = buffer (TEE_Malloc)', 'TEE_GenerateRandom(buffer, count); TEE_MemMove(data, buffer, count);']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:49

フェーズ: ['unknown']

詳細: ["data pointer (a_ptr) from TEE alloc_get_tee_attribute_data is copied by length 'size' into realloc'd buffer without upstream semantic validation of 'size' vs expected attr capacity"]

ルール: weak_input_validation

['rc = serialize(bstart, &buf_len, data, size);']

関数: ['=', 'alloc_and_get']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:119

フェーズ: ['unknown']

詳細: ["binds callee 'args' to caller ctrlargs (derived from REE-provided memref buffer)", "binds callee 'orig_next' to caller orig_next (cursor into REE buffer)", "binds callee 'buf0' to caller &head (TA-local source header)", "binds callee 'out' to caller &p (TA-local recipient pointer)", 'Propagates head.size (from reader-controlled args) into alloc_and_get which uses it for allocation/copy without an explicit semantic upper bound.']

ルール: other, weak_input_validation

['rc = alloc_and_get(args, orig_next, &head, sizeof(head), &p, head.size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:136

フェーズ: ['unknown']

詳細: ['caller passes &attr (stack) as out; function reads src from args (which originates from REE-visible buffer) and copies size bytes into caller stack object']

ルール: other

['rc = serialargs_get(args, &attr, sizeof(attr));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:140

フェーズ: ['unknown']

詳細: ["binds callee 'args' to caller ctrlargs (REE-derived) at second call site", "binds callee 'orig_next' to caller orig_next (REE cursor) at second call site", "binds callee 'buf0' to caller &attr (TA-local header) at second call site", "binds callee 'out' to caller &p (TA-local) at second call site"]

ルール: other

['rc = alloc_and_get(args, orig_next, &attr, sizeof(attr), &p, attr.attrs_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:163

フェーズ: ['unknown']

詳細: ['caller passes &session_handle as out; function copies size bytes from args-derived src (potentially REE memory) into caller stack variable', "alias of serialargs structure (initialized from caller ctrl->memref.buffer) is passed as 'args' (originates from REE-visible memref)", "caller-provided output pointer (&session_handle) passed as 'out' to callee; callee writes into caller stack/TA-private memory"]

ルール: other

['rv = serialargs_get(args, &session_handle, sizeof(uint32_t));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:176

フェーズ: ['unknown']

詳細: ['caller passes head (attributes structure built from templates ultimately derived from REE input) into get_attribute_ptr; alias of possibly untrusted-origin attributes', 'attr_ptr out-parameter is bound to storage inside attribute structures (may alias into template-derived memory)', 'attr_size out-parameter is written with attribute size returned from get_attribute_ptrs; size may originate from untrusted attribute metadata']

ルール: other

['rc = get_attribute_ptr(head, attribute, &attr_ptr, &size);', 'get_attribute_ptrs(head, attribute, attr_ptr, attr_size, &count);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:184

フェーズ: ['unknown']

詳細: ["Binding: src 'data' originates from attribute buffer (serialargs/template) likely originating from REE; copied into local value_len (stack) via TEE_MemMove."]

ルール: other

['TEE_MemMove(&value_len, data, data_size);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:191

フェーズ: ['unknown']

詳細: ['value_len derived from attribute (originating from template/serialargs) is used to TEE_Malloc without an explicit upper bound check', 'Allocates value using value_len derived from template attribute without an explicit upper bound check.', 'value_len is taken from an attribute and used to TEE_Malloc without an explicit upper bound, allowing large allocations or resource exhaustion.', 'value_len derived from attribute (caller-controlled template) is used to allocate without an application-level upper bound', 'value_len derived from caller-provided attribute is used to allocate memory without an explicit upper bound check', 'value_len derived from a caller-controlled attribute is used as allocation size without an explicit upper bound check']

ルール: weak_input_validation

['value = TEE_Malloc(value_len, TEE_USER_MEM_HINT_NO_FILL_ZERO);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:195

フェーズ: ['unknown']

詳細: ["callee buffer parameter is an alias of a TEE_Malloc'd buffer (TEE-private) passed into TEE_GenerateRandom"]

ルール: other

['TEE_GenerateRandom(value, value_len);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:289

フェーズ: ['unknown']

詳細: ["caller-provided client pointer (from tee_session) is passed through as callee 'client' parameter; origin not proven TEE-private", 'alias of shared params array (caller-provided TEE_Param memrefs) passed into helper; memref buffers are REE-visible']

ルール: other

['rc = entry_generate_secret(client, ptypes, params);']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:322

フェーズ: ['unknown']

詳細: ['Binding: destination out->memref.buffer is caller-provided REE-visible buffer; obj_handle (TEE-private) copied into it.', 'obj_handle (TA-private) is copied into caller-provided out memref (REE-visible); rc already validated out->memref.size == sizeof(obj_handle)', 'Destination is caller-provided out->memref.buffer (REE-visible) bound to TEE_MemMove dest parameter.', 'Source is &obj_handle (TA-local) bound to TEE_MemMove src parameter.', 'Writes TA-local object handle into REE-visible out->memref.buffer; bounds checked but structurally exposes TA-managed handle to REE.', 'Writes generated object handle into caller-provided output memref (REE-visible)']

ルール: other

['TEE_MemMove(out->memref.buffer, &obj_handle, sizeof(obj_handle));']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:344

フェーズ: ['unknown']

詳細: ['tee_obj handle (TEE object) passed into TEE_GetObjectBufferAttribute; handle is TEE-private', 'size out-parameter (&sz) bound by TEE_GetObjectBufferAttribute on first probe call', 'tee_obj handle originates from caller (TEE-private) and selects which attribute is queried; taint of handle affects returned size/data', 'attribute selector (attribute) influences returned data and its sensitivity (can select private key material)', 'tee_obj handle (TEE-private) passed into TEE_GetObjectBufferAttribute probe call; callee reads object metadata', 'address of local sz passed so callee writes required size back to caller']

ルール: other

['res = TEE_GetObjectBufferAttribute(tee_obj, attribute, NULL, &sz);']

関数: ['unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:348

フェーズ: ['unknown']

詳細: ['queried size (sz) is used to allocate memory without explicit upper bound check; large sizes could lead to excessive allocation', 'Queried size sz is used to allocate memory without an explicit upper bound check; large or malformed sizes could lead to excessive allocation (resource exhaustion).']

ルール: other

['ptr = TEE_Malloc(sz, TEE_USER_MEM_HINT_NO_FILL_ZERO);']

関数: ['TEE_GetObjectBufferAttribute', '=', 'unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:352

フェーズ: ['unknown']

詳細: ['Copies object attribute into allocated buffer via TEE_GetObjectBufferAttribute; provenance is TEE object attribute (TEE-private)', 'destination buffer ptr provided by caller is filled with object attribute bytes; buffer was allocated locally via TEE_Malloc', 'TEE_GetObjectBufferAttribute copies attribute data (sz bytes) from TEE object into ptr; provenance is TEE object attribute (TEE-private)', 'allocated ptr receives attribute data from TEE (may contain secret key bytes); caller later copies this into TA structures', 'Allocated buffer ptr receives attribute data which may contain secret key bytes; downstream code copies these attributes into TA-managed structures and may eventually export them to REE.', "Copies TEE object attribute into allocated buffer via TEE_GetObjectBufferAttribute; buffer is TEE_Malloc'ed and later returned to caller", "buffer ptr (TEE_Malloc'ed) passed as destination for attribute data; callee writes attribute bytes into this TA-allocated buffer", 'address of sz passed so callee may update actual size written into ptr']

ルール: other

['res = TEE_GetObjectBufferAttribute(tee_obj, attribute, ptr, &sz);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:553

フェーズ: ['unknown']

詳細: ['Copies key handles into caller-provided out buffer; structural risk but not promoted to unencrypted_output here.', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); structural risk: REE-visible destination but values are non-sensitive handles', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); destination is shared even though handles are non-sensitive.', 'alias of caller-provided out->memref.buffer bound to hdl_ptr (shared buffer passed into helper)', 'params (caller-provided memrefs) alias into local pointers (ctrl/out/hld_ptr); shared buffer provenance is REE-visible which is a structural risk to track.', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); while handles are non-sensitive, this is an alias of shared buffer passed from REE.']

ルール: other

['TEE_MemMove(hdl_ptr, &pubkey_handle, sizeof(pubkey_handle));', 'hdl_ptr = (uint32_t *)out->memref.buffer;']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:555

フェーズ: ['unknown']

詳細: ['Copies generated key handles into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though handles are non-sensitive', 'Writes generated key handles into caller-provided out buffer (REE-visible); potential information flow to REE occurs at this different sink line.', 'Copies generated handles into caller-provided out buffer; structural risk recorded.', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); handles are non-sensitive but destination is REE-visible', 'Copies generated key handles into caller-provided out->memref.buffer (shared/REE-visible); handles are non-sensitive but destination is shared.', 'Copies generated key handles into caller-provided out buffer (shared); structural risk of exposing handles though not classified as sensitive here.', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); handles are non-sensitive but writing into shared memory is structural risk to track.', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though handles are non-sensitive in context', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); handles are non-sensitive but the copy is to shared memory.', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); handles are not treated as sensitive here but destination is shared.', 'Copies key handles into caller-provided out buffer (REE-visible); ensure no TA-private secret is placed into this buffer.', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); structural risk of exposing handles to REE', 'Binding: hdl_ptr aliases out->memref.buffer (REE-visible); pubkey_handle (TEE-private) copied into that shared buffer.', 'Destination hdl_ptr is alias of out->memref.buffer (caller-provided REE-visible) bound to dest.', 'Source &pubkey_handle is TA-local bound to src parameter.', 'Writes generated key handles into caller-provided out->memref.buffer (REE-visible).', 'alias of caller-provided out->memref.buffer passed as dest (shared/REE-visible) into TEE_MemMove at key-pair creation site', 'alias of TA-local pubkey_handle passed as src into TEE_MemMove', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though handles are considered non-sensitive', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible) via TEE_MemMove; destination is shared/REE-visible though handles are non-sensitive.', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); structural risk since destination is shared memory.', 'Copies created key handles into caller-provided out buffer (REE-visible); potential information flow to REE depending on handle semantics.', 'Copies generated key handles into caller-provided out->memref.buffer (REE-visible); structural risk of exposing handles to REE.']

ルール: other

['TEE_MemMove(hdl_ptr, &pubkey_handle, sizeof(pubkey_handle));', '&pubkey_handle']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:556

フェーズ: ['unknown']

詳細: ['Binding: hdl_ptr+1 aliases out->memref.buffer (REE-visible); privkey_handle (TEE-private) copied into that shared buffer.', 'Destination hdl_ptr + 1 writes into caller-provided buffer (REE-visible) via dest parameter.', 'Source &privkey_handle is TA-local bound to src parameter.', 'Writes generated private key handle into caller-provided out->memref.buffer (REE-visible).', 'alias of caller-provided out->memref.buffer+1 passed as dest (shared/REE-visible) into TEE_MemMove for priv key handle', 'alias of TA-local privkey_handle passed as src into TEE_MemMove', 'Copies generated private key handle into caller-provided out->memref.buffer (REE-visible); structural risk due to shared buffer write.']

ルール: other

['TEE_MemMove(hdl_ptr + 1, &privkey_handle, sizeof(privkey_handle));', '&privkey_handle']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:605

フェーズ: ['unknown']

詳細: ['alias of pub_head pointer (caller-controlled template) passed into helper; head originates from REE-derived templates']

ルール: other

['if (remove_empty_attribute(pub_head, PKCS11_CKA_EC_POINT) ||']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:607

フェーズ: ['unknown']

詳細: ['alias of priv_head pointer (caller template) passed into helper; head originates from REE-derived templates']

ルール: other

['remove_empty_attribute(priv_head, PKCS11_CKA_EC_PARAMS)) {']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:628

フェーズ: ['unknown']

詳細: ["Binding of callee 'db' parameter to caller 'object_db' at alternative call site; db is TA-managed", "Binding of callee 'ptr' parameter to caller 'obj' at alternative call site; ptr is object pointer (TEE-managed)"]

ルール: other

['handle = handle_get(object_db, obj);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:649

フェーズ: ['unknown']

詳細: ["alias of priv_head (callee 'head') passed from generate_ec_keys; origin is TA-managed structures built from REE-provided templates", "alias of a_ptr (callee 'data') passed from generate_ec_keys; a_ptr derived from REE-provided EC_PARAMS"]

ルール: other

['rc = add_attribute(priv_head, PKCS11_CKA_EC_PARAMS, a_ptr, a_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:653

フェーズ: ['unknown']

詳細: ['alias of pub_head pointer (originating from caller templates that may be REE-derived) passed into tee2pkcs_ec_attributes', 'alias of priv_head pointer (may contain attributes from REE templates) passed into tee2pkcs_ec_attributes', 'alias of tee_obj handle (TEE-allocated key object) passed into tee2pkcs_ec_attributes; tee_obj is TEE-private']

ルール: other

['rc = tee2pkcs_ec_attributes(pub_head, priv_head, tee_obj, tee_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:739

フェーズ: ['unknown']

詳細: ['alias of pub_head pointer (caller-controlled template) passed into helper at alternate call-site']

ルール: other

['if (remove_empty_attribute(pub_head, PKCS11_CKA_EC_POINT) ||']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:740

フェーズ: ['unknown']

詳細: ['alias of priv_head pointer (caller template) passed into helper at alternate call-site']

ルール: other

['remove_empty_attribute(priv_head, PKCS11_CKA_VALUE) ||']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:741

フェーズ: ['unknown']

詳細: ['alias of priv_head pointer (caller template) passed into helper at alternate call-site']

ルール: other

['remove_empty_attribute(priv_head, PKCS11_CKA_EC_POINT) ||']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:779

フェーズ: ['unknown']

詳細: ["alias of priv_head (callee 'head') passed from generate_ec_keys at second call-site; same origin as above", "alias of a_ptr (callee 'data') passed from generate_ec_keys at second call-site; a_ptr derived from REE-provided EC_PARAMS"]

ルール: other

['rc = add_attribute(priv_head, PKCS11_CKA_EC_PARAMS, a_ptr, a_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:1046

フェーズ: ['unknown']

詳細: ['Binding: out->memref.buffer (REE-visible) receives obj_handle copied from TEE-private storage via TEE_MemMove.', 'Destination out->memref.buffer (caller-provided REE-visible) bound to dest parameter.', 'Source &obj_handle is TA-local bound to src parameter.', 'alias of caller-provided out->memref.buffer passed as dest into TEE_MemMove at object creation site', 'alias of TA-local obj_handle passed as src into TEE_MemMove']

ルール: other

['TEE_MemMove(out->memref.buffer, &obj_handle, sizeof(obj_handle));', '&obj_handle']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:1624

フェーズ: ['unknown']

詳細: ['caller passes &bbool/&sz (TEE-private locals) as attr/attr_size to get_attribute; head originates from templates derived from REE input']

ルール: other

['if (!get_attribute(head, attribute, &bbool, &sz) && !!bbool == val)']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:2134

フェーズ: ['unknown']

詳細: ['caller passes &boolval/&boolsize (possibly from object attributes derived from REE) into get_attribute']

ルール: other

['rc = get_attribute(obj->attributes, PKCS11_CKA_EXTRACTABLE, &boolval, &boolsize);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:2140

フェーズ: ['unknown']

詳細: ['caller passes &boolval/&boolsize (object attrs) into get_attribute; attributes ultimately originate from templates']

ルール: other

['rc = get_attribute(obj->attributes, PKCS11_CKA_SENSITIVE, &boolval, &boolsize);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:2259

フェーズ: ['unknown']

詳細: ['caller passes &boolval/&boolsize (object attrs) into get_attribute; values are checked for trust flags']

ルール: other

['rc = get_attribute(obj->attributes, PKCS11_CKA_TRUSTED, &boolval, &boolsize);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:2456

フェーズ: ['unknown']

詳細: ['caller requests PKCS11_CKA_VALUE_LEN into &key_length/&size where attribute storage may originate from REE-provided templates']

ルール: other

['rc = get_attribute(*head, PKCS11_CKA_VALUE_LEN, &key_length, &size);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing_ec.c:559

フェーズ: ['unknown']

詳細: ['Copies TEE-managed public coordinate x into an allocated ecpoint buffer via TEE_MemMove; ecpoint later stored into attr structures', 'Copies public X coordinate from TEE attribute into constructed ecpoint buffer.', 'binding: destination pointer is an ecpoint buffer allocated via TEE_Malloc (TEE-private) passed as dest', 'binding: source pointer x_ptr originates from alloc_get_tee_attribute_data (TEE-private)', 'binding: length argument x_size (attribute length) drives copy size']

ルール: other

['TEE_MemMove(ecpoint + hsize + poffset, x_ptr, x_size);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing_ec.c:564

フェーズ: ['unknown']

詳細: ['Copies TEE-managed public coordinate y into ecpoint via TEE_MemMove; ecpoint then added to public and private attribute lists', 'Copies public Y coordinate from TEE attribute into constructed ecpoint buffer.', 'binding: destination pointer is ecpoint buffer (TEE-private) passed as dest for y coordinate', 'binding: source pointer y_ptr originates from alloc_get_tee_attribute_data (TEE-private)', 'binding: length argument y_size (attribute length) drives copy size']

ルール: other

['TEE_MemMove(ecpoint + hsize + psize + poffset, y_ptr, y_size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing_ec.c:839

フェーズ: ['unknown']

詳細: ['binding: destination ctx->ctx passed as dest (likely TEE-private buffer) into TEE_MemMove', 'binding: source ctx_data passed into TEE_MemMove; provenance unclear (could be REE-derived)', 'binding: length ctx_len drives copy size into ctx->ctx']

ルール: other

['TEE_MemMove(ctx->ctx, ctx_data, ctx_len);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing_rsa.c:708

フェーズ: ['unknown']

詳細: ['Copies attribute bytes (a_ptr) into local modulus_bits via TEE_MemMove; a_ptr provenance uncertain (could be from processed template), but size is validated prior', 'Copies attribute bytes into local modulus_bits after get_attribute_ptr; relies on get_attribute_ptr to have validated size.', 'Binding: destination parameter aliases local modulus_bits (TEE-private) passed as &modulus_bits into TEE_MemMove', 'Binding: source parameter aliases a_ptr which was obtained from attribute template; provenance unclear (could be REE-derived or TA-allocated)', 'Copies bytes from a_ptr into local modulus_bits; source provenance uncertain though size was validated to sizeof(uint32_t)', 'Source a_ptr provenance uncertain though size validated; copy into local modulus_bits may be safe but upstream origin unknown.']

ルール: other

['TEE_MemMove(&modulus_bits, a_ptr, sizeof(uint32_t));']

関数: ['TEE_CipherDoFinal']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing_symm.c:1052

フェーズ: ['unknown']

詳細: ['Potential disclosure: cipher output is written into out_buf (caller-owned REE-visible) from TA-private key material; there is a bounds check that may prevent overflow.']

ルール: other

['res = TEE_CipherDoFinal(proc->tee_op_handle, in_buf, in_sz, tmp_buf, &tmp_sz);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/processing_symm.c:1078

フェーズ: ['unknown']

詳細: ["Call-site binding: destination in_buf is TEE_Malloc'd buffer (TA-private) receiving data.", 'Call-site binding: source is (uint8_t *)data + in_sz aliasing caller-provided TA-private data (sensitive key material).', "Call-site binding: length argument 'align' derived from data_sz % TEE_AES_BLOCK_SIZE (tainted by data_sz)."]

ルール: other

['TEE_MemMove(in_buf, (uint8_t *)data + in_sz, align);']

関数: ['TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/serializer.c:33

フェーズ: ['unknown']

詳細: ["Copies 'size' bytes from src (derived from untrusted serialargs) into out; size is caller-provided and may be attacker-controlled.", 'Performs TEE_MemMove(out, src, size) where src originates from args (likely REE-backed) and size is caller-controlled; limited check relies on serialargs_get_ptr correctness', 'Performs TEE_MemMove(out, src, size) where src originates from args (likely REE-backed) and size is caller-controlled; relies on serialargs_get_ptr correctness', "Copies 'size' bytes from caller-controlled src (derived from args) into out via TEE_MemMove without visible bounds/sanity checks on args contents.", "Copies 'size' bytes from caller-controlled src into out via TEE_MemMove without additional local bounds/sanity checks at this function boundary.", "TEE_MemMove copies 'size' bytes from src (from args/REE) into out (TA-private); source is REE-controlled shared memory", 'Copies size bytes from src (derived from args buffer, i.e., REE-provided) into out without validating content, potentially letting untrusted bytes drive session_handle.', "Copies 'size' bytes from src (derived from caller-controlled serial buffer) into out without further validation of src contents or that size fits destination.", "Copies 'size' bytes from src derived from a REE-controlled serial buffer into out without further validation of src contents; relies on callers to ensure size matches destination."]

ルール: weak_input_validation, other

['TEE_MemMove(out, src, size);', 'if (!rc) TEE_MemMove(out, src, size);']

関数: ['TEE_MemMove', '=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/serializer.c:34

フェーズ: ['unknown']

詳細: ["Copies 'size' bytes from src (derived from untrusted serialargs/REE buffer) into out without additional bounds validation here; size is attacker-influenced", 'Binding: src argument originates from caller-controlled serialargs buffer (REE-visible); alias of shared buffer passed into helper', 'Binding: out parameter (destination) is caller-provided storage or local buffer and receives copied data; callee dest aliasing to caller storage', "alias of caller-provided 'out' (TA-local/out param) passed as dst here; destination originates from caller context", "alias of 'src' pointer (from serialargs_get_ptr) passed as src here; src is derived from args which originates from REE-provided buffer", "copies 'size' bytes from src (derived from args/REE) into out without validating that src contents or full bounds are trusted here", "Copies 'size' bytes from REE-derived src into TA memory without an explicit visible bounds check here tying size to destination capacity.", 'Copies size bytes from src (derived from args/REE data) into caller-provided out using TEE_MemMove; size originates from caller-controlled call and may be unvalidated.', "Copies 'size' bytes from src (derived from args/REE data) into out using TEE_MemMove; size is caller-influenced and may be unvalidated.", "Copies 'size' bytes from src (derived from serialargs_get_ptr reading args which originate from REE) into caller stack object 'out' (TEE-private) via TEE_MemMove", 'Copies bytes from args-derived src (REE) into local attr object; relies on serialargs_get_ptr for bounds validation', 'TEE_MemMove copies size bytes from src (derived via serialargs_get_ptr from REE data) into out without validating size or src provenance', 'Copies size bytes from src (derived from serialargs_get_ptr reading REE-controlled args) into caller-provided out without validating src provenance beyond serialargs_get_ptr return', "TEE_MemMove copies 'size' bytes from REE-derived src into TA memory without explicit validation at this callsite.", "Copies 'size' bytes from src (derived from args/REE input) into out without explicit local validation here; size is caller-provided.", "Copies 'size' bytes from src (derived from serialargs/REE input) into out without local validation here; size is caller-controlled.", "Call-site binding: destination 'out' at serialargs_get call is alias of caller-local buffer (e.g. &attr or &session_handle) - TEE-private.", "Copies 'size' bytes from src (derived from untrusted serialargs) into out; size may be attacker-controlled.", "Call-site binding: destination 'out' aliases caller-provided 'out' (TA-private) while src originates from serial buffer (REE-visible).", "Copies bytes from 'src' (may point into REE-originated serialargs buffer) into 'out' (TA-local destination), propagating untrusted input into TA memory.", "TEE_MemMove copies 'size' bytes from src (derived from args) to out without additional bounds validation here", "Copies 'size' bytes from src (derived from serialargs, likely REE-origin) to out without local bounds validation at this call-site", 'Performs TEE_MemMove(out, src, size) using size derived from caller without explicit upper-bound here', "Copies 'size' bytes from src (derived from args->next, REE-provided) into caller dest without an upper-bound check here", "Copies 'size' bytes from src (derived from REE-provided serialargs) into out without further type/value validation of contents", "Copies 'size' bytes from src (derived from REE-provided serialargs) into caller 'out' without validating content beyond size", "Copies 'size' bytes from src (derived from REE-provided serialargs) into out without validating the semantic/value of the data.", "Copies size bytes from src (originating from serialargs_get_ptr -> args, REE-backed) into caller 'out' without additional local bounds verification", "binding: 'out' argument is caller-supplied (e.g. &session_handle) passed into TEE_MemMove", "binding: 'src' argument originates from serialargs_get_ptr(args) which is backed by REE memref buffer", 'Copies size bytes from src (derived from args/REE buffer) into out without content validation beyond serialargs_get_ptr success.', "Copies 'size' bytes from src (derived from caller-controlled serialargs) into out (TA-private) without content validation beyond serialargs_get_ptr success.", 'src pointer originates from serialargs_get_ptr which reads from caller-controlled buffer (alias of REE-visible memory).', "Call-site binding: destination 'out' aliases caller-provided out pointer (here &session_handle in caller).", "Copies 'size' bytes from caller-controlled src (derived from args) into out via TEE_MemMove; relies on serialargs_get_ptr but lacks local bounds sanity here.", "TEE_MemMove copies 'size' bytes from src (derived from args/REE) into out without additional provenance checks here.", 'Copies sizeof(uint32_t) from src derived from serialargs (REE-provided) into caller out (TEE-private) without extra provenance checks here.', 'Copies bytes from src (derived via serialargs_get_ptr from REE-provided buffer) into out without visible content validation; untrusted session_handle can influence control flow.', "dst parameter 'out' binds to caller-provided buffer (caller stack variable), receiving bytes from src.", "src parameter 'src' originates from serialargs_get_ptr which points into REE-provided serial buffer.", 'Copies untrusted bytes from REE-visible src into TA memory without content validation; session_handle can be attacker-controlled.', 'Copies untrusted bytes from src (derived via serialargs_get_ptr into REE buffer) into TA memory without content validation; may allow attacker-controlled session_handle.', "TEE_MemMove copies 'size' bytes from src (from args, originated from REE-visible buffer) into out (caller-provided TA buffer), creating REE->TA flow.", "Copies 'size' bytes from src (originating from serialargs, which is backed by caller memref buffer) into out; creates REE->TA flow from shared buffer into TA memory.", "TEE_MemMove copies 'size' bytes from args-derived src into out; overall REE->TA flow recorded though caller used this to read a session handle.", 'Copies size bytes from src (derived from REE-controlled serialargs) into out via TEE_MemMove; src is attacker-influenced even though rc is checked.', 'Copies size bytes from src (derived from REE-controlled serialargs_get_ptr) into caller out; src is attacker-influenced though call-site checks rc.', "Call-site binding: 'out' parameter aliases caller stack variable (e.g., &session_handle) written by TEE_MemMove.", "Call-site binding: 'size' argument controls copy length (influences amount of REE-origin data moved).", 'Generic risk: TEE_MemMove moves attacker-influenced bytes from a shared-source into local memory; correctness depends on prior validation of size and src pointer.', 'Copies attacker-influenced bytes from serialargs into TA memory; correctness depends on upstream validation.', "Copies 'size' bytes from src (derived from REE-controlled args) into out without validating that src content is a well-formed integer/session handle.", "Copies 'size' bytes from src (derived from REE-controlled serialized args) into out without validating src content semantics.", 'Copies attacker-controlled serialized bytes into TA-local session_handle without semantic validation.', "Performs direct copy of 'size' bytes from src (derived from caller-provided buffer via serialargs_get_ptr) into out without additional validation beyond serialargs_get_ptr.", "Binding dst 'out' to caller-provided pointer (TA-private) and src to args-derived pointer (shared/REE-visible); record aliasing of parameters.", "Copies 'size' bytes from src (derived from args buffer, likely REE-provided) into caller-supplied out buffer via TEE_MemMove; source is REE-tainted.", "Copies 'size' bytes from src (derived from serialargs, likely REE-provided) into caller out buffer; source is REE-tainted.", "Binding dst argument to caller-provided 'out' (caller stack/local) so callee writes into caller memory.", "Copies 'size' bytes from args-derived src (REE-visible) into caller-provided out buffer; guarded by serialargs_get_ptr but source is REE-tainted.", "Copies 'size' bytes from src (obtained via serialargs_get_ptr from args) into out; src may originate from REE-visible buffer via args.", "Binding of dest parameter to caller 'out' which is TA-private stack storage (&session_handle) at call-site; records aliasing origin.", 'Binding of src parameter to pointer obtained from serialargs_get_ptr which may reference REE-originated buffer via args; records possible REE->TA origin.', 'Copies size bytes from src (derived from args which is REE-originated) into out via TEE_MemMove; src may be attacker-controlled if serialargs_get_ptr insufficiently validated.', "Call-site binding: 'out' parameter aliases caller-provided destination (e.g., &session_handle) which is TA-private at this call-site.", "Call-site binding: 'src' parameter aliases a pointer obtained from serialargs_get_ptr over args (which is built from REE memref), so src is REE-originated/shared.", "Copies 'size' bytes from src (derived from REE buffer) into out without additional size/overlap checks here; src may be attacker-controlled.", 'Copies bytes from REE-derived src into TA memory; if serialargs_get_ptr lacks adequate bounds/format validation, attacker-controlled input may influence parsed values.', "TEE_MemMove copies 'size' bytes from 'src' (derived from args/serial buffer, potentially REE-controlled) into caller-supplied out buffer.", "Destination 'out' is a TA-private buffer in serialargs_get but receives data from 'src' derived from args (potentially REE-controlled).", "Source 'src' originates from serialargs_get_ptr reading from a serial buffer (caller-controlled), so memmove copies REE-controlled bytes into TA memory.", "Call is dependent on 'size' provided by caller path; if serialargs_get_ptr did insufficient validation, this copy could be out-of-bounds.", "Copies 'size' bytes from src (derived from args -> shared REE buffer) into out without visible bounds check here; if serialargs_get_ptr insufficiently validated, untrusted data is copied into TA memory.", "Copies 'size' bytes from src derived from serialargs (REE-visible) into out without local bounds here; untrusted src can influence TA memory.", "Copies 'size' bytes from src derived from serialargs into TA memory; correctness depends on serialargs_get_ptr validation.", 'Copies from src derived via serialargs_get_ptr (likely REE-controlled) into out (&session_handle) which is TA-private; records binding of src/dest provenance.', 'Copies size bytes from src (derived from serialargs/REE buffer) into out via TEE_MemMove; src is untrusted and size-driven copy may be attacker-controlled.', "Copies 'size' bytes from src (derived from serialargs/REE buffer) into out (caller-provided); src is untrusted and length-driven copy may be attacker-controlled.", "Copies 'size' bytes from src (likely pointer into args->buffer derived from REE) into caller-provided out without additional validation of content.", "Binding: callee 'out' parameter is the caller's &session_handle (TA-local destination) passed into TEE_MemMove at call-site.", "Binding: callee 'src' parameter originates from args->buffer which was initialized from an REE-provided memref (shared/REE-visible).", "Binding: callee 'size' parameter is a caller-supplied length (numeric) used to control the copy; provenance and bounds validation depend on caller.", "Copies 'size' bytes from a source that may be REE-visible into a TA destination without additional validation here; caller must ensure bounds and trustworthiness.", "Copies 'size' bytes from a source derived from REE into TA-local memory without local validation here; relies on caller and serialargs_get_ptr to ensure bounds.", "Copies 'size' bytes from src (derived from args, potentially REE-shared buffer) into out via TEE_MemMove; risk of copying REE-provided data into TA memory if src is shared", "dest 'out' is written from src derived from args (which was initialized from ctrl->memref.buffer, REE-provided/shared); binding callee 'dest'/'src' to caller origins", "Copies 'size' bytes from src (derived from args/REE-controlled buffer) into out (TA-private); source is REE-visible shared memory.", "Copies 'size' bytes from src (derived from args which may be REE-provided) into out without content validation; untrusted bytes can control copied data.", "Call-site binding: destination 'out' is callee-provided pointer (alias of caller's out) at serialargs_get call.", "Copies 'size' bytes from src (derived from serialargs buffer, REE-controlled) into out without validating src contents or size against destination capacity.", 'Copies size bytes from src into out via TEE_MemMove without local verification of src length in this function (relies on serialargs_get_ptr).', 'Copies size bytes from src (bound to caller ctrl->memref.buffer) into out without local verification here; relies on upstream checks.', 'Copies size bytes from REE-provided src into out without local verification in this function; relies on serialargs_get_ptr/upstream validation.', "Copies 'size' bytes from src (obtained from args which references REE-visible memref) into out (caller buffer); flow moves REE-origin data into TA caller buffer.", "Copies 'size' bytes from src (obtained from serialargs_get_ptr which may reference REE-provided memref) into caller buffer 'out'; binds callee params to REE-derived source and caller destination.", "TEE_MemMove copies 'size' bytes from src (derived from args which may reference REE buffer) into out; correctness relies on serialargs_get_ptr's validation of bounds.", "Destination 'out' (caller-provided) receives size bytes from src derived from serialargs_get_ptr which reads from REE-originated buffer; relies on upstream validation.", "Call-site binding: 'src' parameter aliases memory obtained from args (which may reference REE-visible buffer).", "TEE_MemMove copies 'size' bytes from src (derived from REE args) into out; correctness depends on serialargs_get_ptr bounds validation.", 'Copies bytes from src (from args->buffer, likely REE-visible) into out via TEE_MemMove without local checks', "Binding dest parameter to caller 'out' (TA-private) at call site — alias of callee dest to local TA storage", 'Binding src parameter to pointer returned by serialargs_get_ptr (likely from args->buffer, REE-visible)', 'Copies bytes from src (from args->buffer, likely REE-visible) into out via TEE_MemMove; relies on serialargs_get_ptr for validation.', 'Copy from src (derived from REE-visible buffer) into caller-provided out pointer (callee writes into caller stack/vars) via TEE_MemMove observed at this call-site.', "Destination 'out' at this call-site is a TA-local variable pointer (callee writes into TA-private storage) while source originates from serialargs_get_ptr (derived from caller-provided REE buffer).", "Source 'src' at this call-site is bound from serialargs_get_ptr which reads from an args-initialized buffer (caller-provided memref).", 'serialargs_get copies from src derived from caller memref into out; src origin is REE-visible buffer initialized by caller.', 'Copies from src (obtained via serialargs_get_ptr, likely wrapping REE-provided buffer) into out; destination origin depends on caller (&token_id in callers) so aliasing between shared and private exists.', "Copies 'size' bytes from src (pointer derived from caller-controlled args) into out without local bounds checks here; size originates from caller in many call-sites.", "Copies 'size' bytes from src (derived from caller-controlled serialargs buffer) into out (TA memory) without local checks here.", "Copies 'size' bytes from src (pointer derived from caller-controlled args) into out without local checks here; relies on serialargs_get_ptr correctness.", 'Copies from src (which may originate from REE memref) into out; binds callee args to a caller-provided buffer origin.', 'Copies from a src pointer supplied by serialargs_get_ptr into caller-provided out; relies on serialargs_get_ptr validation.', "Copies 'size' bytes from src derived from REE-provided args into out without additional semantic validation of 'size' vs remaining buffer.", "Call-site binding: destination 'out' is TA-private (&old_pin_size/&pin_size) while source 'src' originates from serialargs buffer initialized from REE.", "Copies 'size' bytes from REE-derived src into TA memory; 'size' is caller-controlled and relies on prior serialargs validation.", "Copies caller-controlled 'size' bytes from REE-derived src into TA memory; relies on serialargs_get_ptr correctness.", "Call-site binding: callee dest 'out' aliases caller-provided TA stack/storage (&user_type or &pin_size) — destination is TA-private.", "Call-site binding: callee src 'src' is provided by serialargs_get_ptr and ultimately originates from ctrl->memref.buffer (REE-visible).", "Copies 'size' bytes from REE-origin src into out without additional validation beyond the earlier pointer retrieval; size is caller-controlled.", "Copies caller-controlled 'size' bytes from REE-origin src into TA-private out without an explicit local bounds check at this line; correctness depends on serialargs_get_ptr's validation.", "Copies 'size' bytes from src (obtained from REE-backed serialargs buffer) into caller-provided out; source is REE-controlled and size origin may be attacker-influenced via serialargs state.", "Binding: destination 'out' at call site comes from caller's out parameter (caller-provided), origin depends on call chain.", "Binding: source 'src' is obtained via serialargs_get_ptr from args which may be backed by REE-visible memref buffer.", "Copies 'size' bytes from REE-backed serialargs buffer into TA memory without explicit per-callsite bounds proof here.", "TEE_MemMove copies 'size' bytes from src (derived from serialargs buffer, REE-origin) into caller-provided out pointer; potential untrusted input copied into TA memory", "TEE_MemMove copies 'size' bytes from src (derived from serialargs buffer initialized from ctrl->memref.buffer, REE-provided) into out (caller TA memory); untrusted src flows into TA memory.", "Copies 'size' bytes from serialargs buffer (initialized from REE memref) into TA memory; ensure serialargs_get_ptr robustly bounds checks.", 'copies size bytes from src (obtained from serialargs_get_ptr, likely derived from REE buffer) into caller out without local validation here', "binding: caller passes 'out' (&object_handle in upstream) as destination into TEE_MemMove; record origin", "copies 'size' bytes from src (obtained from serialargs_get_ptr, likely derived from REE buffer) into out without validation here", 'copies size bytes from src (obtained from serialargs_get_ptr, likely derived from REE buffer) into out without validation here', "Copies 'size' bytes from src (returned by serialargs_get_ptr, likely into REE-provided memref buffer) into caller-supplied out via TEE_MemMove", "Call-site binding: destination 'out' is caller-provided pointer (callee dst aliases caller variable)", "Call-site binding: source 'src' originates from serialargs_get_ptr reading from args (likely REE-provided buffer)"]

ルール: weak_input_validation, other

['if (!rc) TEE_MemMove(out, src, size);', 'TEE_MemMove(out, src, size);', 'if (!rc)\n\tTEE_MemMove(out, src, size);', 'TEE_MemMove(dst, src, size);', 'rc = serialargs_get_ptr(args, &src, size);', 'rc = serialargs_get_ptr(args, &src, size); if (!rc) TEE_MemMove(out, src, size);']

関数: ['serialargs_get_ptr', 'unknown']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/serializer.c:48

フェーズ: ['unknown']

詳細: ["Uses 'size' (derived from reader-controlled data) to compute allocation/copies; only overflow check and serialargs_get_ptr error cover it but no explicit upper bound on size.", "Uses 'size' from reader-controlled input to allocate and copy without an explicit semantic upper bound (resource/exhaustion risk).", "Uses 'size' (attr.attrs_size) from untrusted serialized input to compute allocation and drive copy; attacker-controlled size may affect allocation and copies despite overflow check."]

ルール: weak_input_validation

['if (ADD_OVERFLOW(buf0_sz, size, &sz))', 'if (ADD_OVERFLOW(buf0_sz, size, &sz))\n    return PKCS11_CKR_ARGUMENTS_BAD;']

関数: ['TEE_Malloc']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/serializer.c:60

フェーズ: ['unknown']

詳細: ["Allocates 'sz' = buf0_sz + size (size controlled by input) and copies both buf0 and src into the allocation; large size may lead to resource exhaustion or unexpected behavior."]

ルール: weak_input_validation

['ptr = TEE_Malloc(sz, TEE_MALLOC_FILL_ZERO);']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/serializer.c:66

フェーズ: ['unknown']

詳細: ["dst 'ptr' (allocated local buffer) passed as dst; ptr is TA-allocated but will contain copied data", "src 'buf0' passed as src; origin uncertain (could be REE-visible or TA-private) from earlier context", 'First TEE_MemMove copies buf0 (likely TA data) into ptr, second copies src (potentially REE-controlled) into ptr+buf0_sz; second copy size may be influenced by REE.', 'Copies buf0_sz bytes from buf0 into ptr; origin of buf0 unclear (could be REE-derived), binding ptr target is TEE-private allocation', 'Copies buf0_sz bytes from buf0 (origin may be REE-visible) into allocated ptr without validating combined sizes/overlap', "Call-site binding: 'ptr' destination is TA-allocated buffer (TEE-private) receiving data from caller buffers.", 'Copies buf0_sz bytes from caller buffers into TA-allocated ptr without local robustness checks here.', "Call-site binding: destination 'ptr' is TA-allocated buffer while source 'buf0' origin is unclear (could be TEE-private).", "Call-site binding: source 'buf0' parameter bound at call-site; origin of buf0 is not shown (unknown region).", 'Copies buf0 (from orig_next/serialargs) into allocated ptr; source likely REE-origin and destination TEE-private, possible untrusted data concatenation without explicit bounds check here.', 'Concatenates pieces read from serialargs into allocated buffer without an explicit bounds check visible here.', 'First call copies buf0_sz bytes from buf0 (origin unclear) into ptr; source/destination origins not fully validated here', 'Assembly copies into allocated buffer using buf0_sz and size without visible bounds checks here', 'Copies buf0_sz bytes from buf0 (likely REE-provided) into allocated ptr without visible bounds check here', 'binding: ptr/dst is target buffer (allocated locally) while buf0/src origins vary; pointer arguments forwarded into TEE_MemMove from upstream callers', "binding: destination 'ptr' passed into TEE_MemMove from caller context", "binding: source 'buf0' passed into TEE_MemMove; provenance unclear", "Dest 'ptr' is a constructed buffer pointer (TA-allocated/unknown) passed as destination for copies.", "src 'buf0' may be caller-controlled/shared memory passed into TEE_MemMove.", "Call-site binding: destination 'ptr' is TA-allocated pointer, src 'buf0' likely from caller-controlled data; origins differ.", 'Destination ptr may be TA-allocated and src buf0 is likely caller-provided; aliasing/binding of pointers at call-site recorded.', "dst parameter 'ptr' binds to TA-allocated buffer receiving first copy chunk.", "src parameter 'buf0' is TA-local data (previously populated); second copy uses 'src' which may be from serialargs (REE-visible).", 'Copies bytes from src into TA buffer without visible validation of content or ensuring combined buffer capacity.', 'First TEE_MemMove copies buf0 (likely from REE or intermediate) into ptr, possibly building a concatenated buffer; records REE->TA aliasing risk.', 'Call-site binding: copies buf0 (origin uncertain) into ptr; origins of ptr and buf0 are local/alloc and/or caller-dependent.', 'Copies buf0 into allocated ptr; buf0 origin unclear (could be REE-controlled), potential aliasing of shared buffers.', 'Copies buf0_sz bytes from buf0 (origin unclear) into ptr; src may be REE-visible or TA-private depending on caller.', 'Binding of dest parameter to allocated ptr which will become returned to caller (*out); alias of TA-allocated buffer passed back to caller.', 'Copies buf0 (origin unclear) into ptr; origin of buf0 may be REE or TA and is not shown here, so binding is uncertain.', 'First TEE_MemMove binds dest ptr and buf0 (src) origins; buf0 provenance unclear (could be REE or TA) so record aliasing.', 'Copies buf0 into ptr then copies src into ptr+buf0_sz; src/buf0 may originate from untrusted serialargs/REE buffers leading to unvalidated concatenation.', "dest 'ptr' is written from buf0 (caller-provided) and then from src; binds callee args to caller buffers (ptr, buf0, src)", 'First copy writes buf0 (likely REE-origin) into ptr (TA-private), second call (line 67) appends src into ptr; origins differ and src may be REE-controlled.', 'Copies buf0 (origin not proven here) into allocated ptr; origin region of buf0 is unknown at this call-site.', 'Copies buf0 into allocated buffer; origin of buf0 unclear at this call-site.', "Call-site binding: destination 'ptr' is TA-allocated target (alias passed into helper).", 'Call-site binding: second call writes src into ptr+buf0_sz; src origin uncertain (could be REE-derived).', 'Copies buf0 into allocated ptr; provenance of buf0 unclear (could be REE or TA), so origin is unknown.', "Copies buf0 into newly allocated ptr; binds callee dst 'ptr' (TA-private) to src 'buf0' (origin unclear from context).", "Call-site binding: destination 'ptr' is TA-allocated (write target) receiving buf0 bytes then more data; dst is TA-private.", 'Binding dest parameter to ptr (allocated/TA-private) for concatenation', 'Binding src parameter to buf0 (origin depends on caller; could be REE-visible or TA-private)', 'First call at this site writes buf0 into allocated ptr; buf0 origin unclear (could be TA or REE), binding observed.', 'Copies buf0 into allocated ptr; buf0 origin (REE vs TA) is unclear at call-site.', 'Copies buf0 into ptr and then src into ptr+buf0_sz; source buffers may be REE-origin and destination ptr is allocator output — potential aliasing and size-controlled arithmetic from callers.', 'Copies with ptr arithmetic and caller-controlled sizes; potential aliasing/size arithmetic risks.', 'Copies buf0_sz bytes into allocated ptr from buf0; operands appear internal (likely TA-private) but origin not fully proven here.', 'Internal copy into allocated buffer; provenance not fully proven here.', 'Copies buf0 into ptr; buf0 likely originates from caller-provided data, so record alias/binding.', "Call-site binding: destination 'ptr' is TA-allocated buffer while source 'buf0' is from earlier buffer possibly derived from REE.", "Call-site binding: callee dest 'ptr' aliases local allocation (ptr) — destination is TA-private.", "Call-site binding: callee src 'buf0' origin unclear (could be TA or REE); origin marked unknown.", "Binding: destination 'ptr' (first call) is TA-allocated buffer (alloc_and_get), origin TA-private.", "Binding: source 'buf0' is from caller/context; origin unclear (could be REE or TA), treated as unknown.", 'TEE_MemMove copies buf0_sz bytes from buf0 into ptr; origins of buf0/ptr uncertain (could be REE-visible or TA-private), potential aliasing of shared buffers.', "binding: destination 'ptr' passed as first arg (TEE-private) to TEE_MemMove", "binding: source 'buf0' passed as second arg; origin unclear (could be REE-visible)", "Call-site binding: first call destination 'ptr' points to allocated buffer (TA-private)", "Call-site binding: first call source 'buf0' provenance uncertain (could be REE or TA); treated as unknown", 'Copies buf0 (likely TA-private struct data) into newly allocated ptr in-place; binding of caller buf0 into dst occurs here', "binds destination 'ptr' (TEE-allocated) to caller-local pointer; copies TA-local header region into allocated buffer", "Copies 'src' read from args (REE-visible) into newly allocated TA-private buffer via TEE_MemMove; origin of src is attacker-controlled.", "Destination 'ptr' is TA-private buffer allocated by TEE_Malloc; source 'buf0' is TA-private (caller stack) copied into TA memory.", "Source 'buf0' originates from caller-provided buffer (caller stack) but is TA-private in this context.", "Copies buf0 (&attr, TEE-private) into malloc'd ptr (TEE-private) via TEE_MemMove; both source and dest are TA-private but size arithmetic influences allocation", 'Copies local attr structure into allocated buffer; safe but size contributes to allocation arithmetic.', 'Copies buf0 (from REE-derived attr) into newly allocated TEE heap via TEE_MemMove', 'Destination ptr is allocated in TEE heap (TEE_Malloc) while source buf0 originates from REE-derived attr; binding of dest pointer is an alias of TEE-private heap', 'Source buf0 was populated from serialargs (REE-controlled); binding records origin as REE-visible', "Copies data from buf0 and src into a TEE-allocated buffer using sizes that include input-derived 'size'; destination is TEE-private but source is REE-originated.", "Call-site binding: destination 'ptr' is TEE-allocated buffer (TEE-private) returned to caller; alias established at alloc_and_get.", "Call-site binding: source 'buf0' originates from local 'attr' populated from args (which come from REE); treat as potentially REE-derived.", "Performs TEE_MemMove from 'src' (data read from serialargs -> likely REE-provided) into TEE_Malloc'd buffer; copying attacker-controlled bytes into TA memory.", "Destination 'ptr' is TA-private (TEE_Malloc) and is written from 'buf0' which is caller-local (TA-private); copy of non-REE data into TA memory.", 'Dest ptr is TA-allocated (TEE-private) and source buf0 is TA-local (&attr); copying buf0 into allocated region.', 'Binding: destination ptr (returned via *out) is TA-private pointer assigned to caller; records allocation origin.', 'size (from upstream attr.attrs_size via serialargs) is used to read from REE (serialargs_get_ptr) and drive copies without additional validation here', 'buf0 (source) is a TEE-private/local stack struct pointer (&attr) passed into memmove as source; dst ptr is TEE-allocated private memory', "binding: dst pointer 'ptr' is returned via out parameter to caller (TEE-private) - alias recorded", "Copies REE-provided 'src' into newly allocated TA-private buffer via TEE_MemMove; destination is TA-private but data originates from REE", 'Copies local header buf0 (TA-private) into allocated TA-private buffer ptr; simple TA->TA move of non-REE data']

ルール: other, weak_input_validation

['TEE_MemMove(ptr, buf0, buf0_sz);', 'TEE_MemMove(ptr, buf0, buf0_sz); TEE_MemMove(ptr + buf0_sz, src, size);', 'TEE_MemMove(ptr + buf0_sz, src, size);', 'TEE_MemMove(ptr, buf0, buf0_sz);\nTEE_MemMove(ptr + buf0_sz, src, size);', '*out = ptr;']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/serializer.c:67

フェーズ: ['unknown']

詳細: ["dst 'ptr + buf0_sz' (pointer arithmetic) passed as dst; arithmetic on TA buffer influenced by sizes possibly from REE", "src 'src' passed as src; provenance may be REE-controlled via serialargs, making copied bytes untrusted", "TEE_MemMove copies 'size' bytes from src (reader-controlled) into ptr+buf0_sz; offset arithmetic with buf0_sz may lead to out-of-bounds if sizes unvalidated.", "Copies 'size' bytes from src into ptr+buf0_sz; src origin uncertain (likely args-derived) and destination is TA-private buffer with pointer arithmetic", 'Copies size bytes from src into ptr+buf0_sz without validating src provenance or that ptr has room for buf0_sz+size', "Copies 'size' bytes from src (possibly REE-originated) into ptr+buf0_sz without local size/sanity checks here.", "Copies 'size' bytes from src (origin may be untrusted) into ptr+buf0_sz; size may be attacker-controlled.", "Copies 'src' into ptr+offset (constructed buffer); 'src' may be REE-originated and write uses computed pointer arithmetic (ptr+buf0_sz).", "Second call copies 'size' bytes from src (likely REE-derived) into ptr+buf0_sz without explicit bounds check here", "Copies 'size' bytes from src (from args) into ptr+buf0_sz without explicit bounds check here", 'binding: second copy into ptr+offset uses src (possibly REE-origin) and caller-controlled offset arithmetic', 'binding: destination ptr+buf0_sz passed into TEE_MemMove (pointer arithmetic may alias buffers)', "binding: source 'src' passed into TEE_MemMove here; provenance unclear at this call-site", "Dest 'ptr + buf0_sz' is pointer arithmetic on buffer; destination aliases constructed buffer and may enable overwrite if sizes miscomputed.", "src 'src' at this site may originate from earlier serialargs_get_ptr or caller buffers (shared/REE-visible).", "Second copy composes ptr + buf0_sz offset and copies 'size' bytes from src without an explicit bounds check here.", 'Second copy into ptr+buf0_sz from src (derived from args) binds caller-provided data into assembled buffer.', "dst parameter 'ptr + buf0_sz' binds to TA-allocated buffer offset receiving bytes from src (potentially REE-derived).", 'Second copy moves bytes from src (potentially REE-controlled) into TA buffer without validation of content or bounds beyond size parameter.', 'Second TEE_MemMove appends src into ptr+buf0_sz; src may be REE-derived and size-driven, so concatenation bounds should be tracked.', 'Call-site binding: copies src (origin unclear) into ptr+buf0_sz; pointer arithmetic on dst uses prior size.', 'Copies src into ptr+offset; src provenance ambiguous (could be REE) and write uses computed offset into allocated buffer.', "Copies 'size' bytes from src into ptr+buf0_sz; pointer arithmetic on dst may alias shared or local memory depending on ptr origin.", "Binding of dest parameter to ptr+buf0_sz (TA-allocated region) and src parameter to 'src' (origin uncertain); records potential mixing of regions.", "Copies 'size' bytes from src into ptr+buf0_sz; if src is from REE-visible input, this writes untrusted bytes into TA buffer without local bounds here.", "Copies 'size' bytes from src into allocated buffer without local visible bounds here; relies on upstream checks.", 'Second TEE_MemMove binds dest (ptr+buf0_sz) and src; src provenance (serialargs-derived) may be REE-visible—record aliasing and taint of size.', "Copies src into ptr+buf0_sz using size 'size' possibly derived from serialargs; addition of offsets may allow attacker-controlled overwrite if sizes/offsets unchecked.", 'Copies src into ptr+buf0_sz using size possibly derived from serialargs; addition of offsets may allow attacker-controlled overwrite if sizes/offsets unchecked.', "dest 'ptr+buf0_sz' is written from src (which may be REE-derived); binds callee args to caller origins", "Copies 'size' bytes from src (potentially REE-controlled) into ptr+buf0_sz (TA-private); offset arithmetic uses buf0_sz which must be trusted.", "Copies 'size' bytes from src into ptr+buf0_sz; src provenance may be REE-visible and size is caller-controlled.", 'Call-site binding: this call writes additional src region into assembled buffer; src may be REE-controlled.', 'Copies src into ptr+buf0_sz; src provenance not established in this site, so treated as unknown.', "Appends 'size' bytes from src into ptr+buf0_sz; binds callee dst (ptr+offset) as TA-private and src origin as unknown/possibly REE-visible.", "Second copy into ptr+buf0_sz uses 'src' and 'size' which may originate from serialargs (REE); relies on upstream bounds checks.", 'Binding dest parameter to ptr + buf0_sz (TA-private) for appending', 'Binding src parameter to src (provided by caller code path; origin not resolved here)', 'Second call at this site copies src into ptr+buf0_sz; origin of src unclear at call-site so binding is recorded as unknown.', 'Copies src into ptr+buf0_sz; src origin unclear at call-site.', 'Copies src into ptr+buf0_sz where ptr arithmetic uses buf0_sz (caller-controlled); index/offset arithmetic driven by sizes from callers.', "Copies 'size' bytes into ptr+offset from src; src provenance may be caller-controlled and size is externally supplied at call-sites.", "Copies 'size' bytes into ptr+offset from src; src provenance may be caller-controlled at call-sites.", 'Copies src into ptr+buf0_sz; src may be REE-origin and offset arithmetic writes into TA memory, record binding and offset usage.', "Call-site binding: destination 'ptr + buf0_sz' is TA-allocated; source 'src' may be REE-derived.", "Call-site binding: callee dest 'ptr + buf0_sz' aliases TA-local allocation region — destination is TA-private.", "Call-site binding: callee src 'src' origin unclear at this call-site (marked unknown).", "Binding: destination 'ptr + buf0_sz' is TA-private pointer arithmetic writing into allocated buffer.", "Binding: source 'src' may originate from serialargs buffer (REE-backed), so copy may move REE-controlled bytes into TA memory.", "TEE_MemMove copies 'size' bytes from src into ptr+buf0_sz; src origin uncertain (could be REE-derived), and write uses pointer arithmetic into ptr.", "binding: destination 'ptr + buf0_sz' (TEE-private pointer arithmetic) passed as first arg", "binding: source 'src' passed as second arg; origin depends on caller (possibly REE-derived)", "Call-site binding: second call destination 'ptr + buf0_sz' is TA-private buffer offset (in-place aliasing risk if arithmetic tainted)", "Call-site binding: second call source 'src' here originates from args/buffer (likely REE-visible)", "Copies 'size' bytes from src (derived from serialargs/REE) into TA-private buffer ptr+buf0_sz; length 'size' is from untrusted args", "copies 'size' bytes from src (obtained via serialargs_get_ptr from REE buffer) into TEE buffer without further validation here", "Destination 'ptr + buf0_sz' is TA-private buffer region; source 'src' is read from args (REE-visible) and copied into TA memory.", "Source 'src' is derived from serialargs_get_ptr reading 'size' bytes from REE-controlled buffer (args).", 'Copies data from src (derived from serialargs -> REE-visible) into TA-allocated buffer (ptr + offset), bringing REE-origin data into TA memory', 'Copies REE-provided serialargs bytes into TA heap; source is untrusted and may require validation before use elsewhere.', 'Copies src (from serialargs/REE) into allocated heap via TEE_MemMove; src originates from REE-controlled serialargs', 'Destination ptr+buf0_sz is derived from TEE-allocated ptr via pointer arithmetic (TEE-private)', 'Source src is obtained from serialargs_get_ptr (REE-controlled) and then copied into heap', "Call-site binding: destination 'ptr + buf0_sz' (offset into TEE-allocated buffer) aliases the same TEE-private allocation.", "Copies 'size' bytes from 'src' (read from args) into dest; 'size' is input-derived (attr.attrs_size) and lacks additional validation here.", "Copies 'src' (data read from serialargs -> likely REE-provided) into TA-private buffer using attacker-influenced 'size' (attr.attrs_size).", "Dest ptr+buf0_sz is TA-allocated; source 'src' is obtained from serialargs_get_ptr and may point into REE-visible memory (shared).", 'src is derived from REE-visible serialargs_get_ptr and size (from upstream attr.attrs_size) controls the copy into TEE memory without local validation here', "Copies 'src' (read from args->next, REE-controlled) into TA-private ptr at offset; data originates from REE"]

ルール: other, weak_input_validation

['TEE_MemMove(ptr + buf0_sz, src, size);']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/serializer.c:145

フェーズ: ['unknown']

詳細: ["Assigns allocated pointer 'p' to caller-provided out; propagates TA-private allocation back to caller"]

ルール: other

['*out = p;']

関数: ['=']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/serializer.c:171

フェーズ: ['unknown']

詳細: ['Writes resolved session pointer back into caller-provided sess (alias of caller stack); records binding of callee output to caller region.', 'Assigns resolved session pointer back to caller-provided sess pointer; records binding.']

ルール: other

['*sess = session;']

関数: ['=', 'TEE_MemMove']

場所: /workspace/benchmark/vuln-ta-collection/optee-pkcs11-cve/ta/serializer.c:188

フェーズ: ['unknown']

詳細: ["dst 'buf + *blen' (offset write) passed as dst; destination offset depends on *blen which may be attacker-influenced leading to potential overflow", "Copies 'len' bytes from data into buf + *blen; *blen and len may be influenced by caller-controlled values leading to overflow if unbounded.", "Appends 'len' bytes from data into buf + *blen; data/source origin may be REE-visible and write uses caller-provided length *blen (tainted arithmetic)", 'Appends len bytes from data into buf + *blen using tainted arithmetic for destination offset', 'Copies len bytes from data (likely REE-controlled) into buf + *blen without explicit bounds check against buffer capacity', "Copies 'len' bytes from data (caller-provided) into buf + *blen without validating that destination has sufficient space here.", 'Copies len bytes from data into buf + *blen without a local check that destination has sufficient space.', "Appends len bytes from data into buf+*blen; 'len' and 'data' may be derived from untrusted input leading to overflow if not checked.", "Call-site binding: destination 'buf + *blen' aliases caller buffer 'buf' (TA-private) while 'data' originates externally (unknown/REE-visible).", 'Appends data using len derived from untrusted input; possible overflow if buffer capacity not enforced', "Copies 'data' into buf+*blen; source provenance unclear (may be REE or TA); destination is TA buffer updated with new length—possible overflow risk if bounds not enforced here.", "Writes data into buf + *blen using a length 'len'—bounds at this point are not evident, posing potential overflow risk.", "Appends 'len' bytes from data into buf + *blen without visible bounds validation at this site", 'Copies len bytes from data into buf + *blen; len and *blen derived from caller-controlled values without local upper-bound here', "Copies 'len' bytes from data into buf + *blen where *blen and len may be influenced by caller data; offset/length not validated here", 'Copy into buffer at offset *blen uses caller-influenced length/offset without local validation here.', 'binding: destination buf + *blen passed into TEE_MemMove (destination may be shared or local depending on caller)', "binding: source 'data' passed into TEE_MemMove; provenance (REE vs TEE) not clear here", "Copies 'len' bytes from data (potentially REE-controlled) into buf + *blen without further validation; risk of overflow if blen/len not checked.", "Destination pointer 'buf + *blen' aliases buffer with runtime offset derived from *blen; origin/limits are unclear.", 'TEE_MemMove(buf + *blen, data, len) copies caller-controlled data into buffer at runtime offset derived from *blen; bounds/limit checks are not obvious here.', "Call-site binding: destination 'buf + *blen' may be TA buffer and source 'data' originates from caller; offset arithmetic present.", "Appends 'len' bytes from caller-controlled data into buf at offset *blen without visible local bounds check here (risk of overflow).", 'Appends data (from caller/REE) into buf at offset *blen without visible bounds check here.', "dst parameter 'buf + *blen' binds to TA buffer offset; destination derived from TA-managed buffer pointer and length.", "Copies 'len' bytes from 'data' (untrusted) into buf without visible range check against actual buffer capacity here.", 'Copies len bytes from data (untrusted) into buf at offset *blen without visible bounds check here.', "Copies 'len' bytes from data into buf + *blen; destination is buffer growth in TA but source may be REE-visible—possible bounds/overflow risk if not checked by caller.", 'Call-site binding: copies data (origin unclear) into buf + *blen; dst arithmetic uses *blen which may be attacker-influenced if not validated here.', "Appends 'len' bytes from data (likely REE-controlled) into buf at *blen without clear bounds check on buf; write target may alias shared/REE-visible memory.", 'Copies len bytes from data (caller-provided) into buf + *blen; destination arithmetic uses *blen which is influenced by TA state and may cause overflow if unchecked.', "Binding src argument to caller 'data' which originates from REE-provided memref (shared).", 'Binding of dest parameter to buf + *blen (buffer concat) and src to data; caller origins uncertain—possible REE-derived data copied into TA buffer or vice versa.', "Copies 'len' bytes into buf + *blen where *blen is attacker-influenced/tainted; possible out-of-bounds/overwrite of destination without evident bounds check here.", "Copies 'len' bytes into buf + *blen where *blen is tainted/variable; potential overwrite if bounds not enforced.", "Copies 'len' bytes from data (likely caller-provided) into buf + *blen (TA buffer) without local bounds here; record possible tainted-size/overflow risk.", "Copies 'len' bytes from data into buf + *blen; data may be REE-supplied and destination offset is attacker-influenced leading to potential overflow.", "dest 'buf + *blen' (caller buffer) is written from data (caller-provided); binds callee args to caller buffer origins and sizes", "Appends 'len' bytes from data into buf+*blen; data/source provenance unclear (could be REE), and write uses dynamic offset *blen.", "Copies 'len' bytes from data into buf + *blen; provenance of data and current buf length should be validated by caller.", "Call-site binding: destination 'buf + *blen' is buffer managed by caller; pointer aliasing of shared/TEE buffer uncertain.", "Copies 'len' bytes from data (caller-controlled) into buf+*blen without explicit bounds check against buffer capacity in this call-site.", 'Copies data into buf+*blen; provenance of data not asserted here and destination is TA buffer—origin unknown.', "Writes 'len' bytes from data into buf + *blen (buffer growth); destination may be TA-managed but size/offset depend on caller-controlled *blen and len.", "Writes 'len' bytes into buf + *blen using caller-managed lengths; potential for out-of-bounds if caller-supplied lengths are incorrect.", "Copies 'len' bytes from 'data' into buf + *blen; 'data' may be from REE and len may be attacker-controlled if upstream checks are insufficient.", "Call-site binding: 'dst' computed as buf + *blen aliases TA buffer with offset derived from TA state; must ensure offset+len within allocation.", 'Binding dest parameter to buf + *blen (buffer in caller; likely REE-visible or TA-private depending on allocation)', 'Binding src parameter to data (origin from caller; may be REE-visible), then copying into buf -- potential shared-memory transfer', "Call copies data into buf + *blen; destination is TA buffer (buf) while source 'data' origin is unclear (could be REE or TA).", 'Copies data into buf + *blen; destination is TA buffer while source origin is unclear.', 'Copies data (likely REE-provided) into buf + *blen; destination offset uses *blen (caller-managed) which can lead to out-of-bounds if not checked here.', 'Copies data into buf + *blen where *blen is caller-managed; if not checked this can overflow destination.', "Appends 'len' bytes from data (possibly caller-controlled) into buf + *blen without local bounds proof here.", 'Copies data (likely caller-supplied) into buf+*blen; tainted length/offset used in destination pointer arithmetic recorded as structural risk.', "TEE_MemMove uses destination pointer with tainted offset buf + *blen and tainted length len; potential offset/size arithmetic risk if callers don't validate.", "Copies 'len' bytes into buf + *blen using len/from data which may be influenced by REE without localized bounds enforcement here.", "Call-site binding: callee dest 'buf + *blen' aliases caller buffer (likely TA-owned) used for accumulation; destination region marked TEE-private.", "Copies 'len' bytes into buf+*blen without local bounds check here; if len or *blen influenced by attacker, may overflow destination.", "Binding: destination 'buf + *blen' is a TA buffer but pointer arithmetic uses *blen (TA-controlled), origin TA-private.", "Binding: source 'data' origin depends on caller; in some call-sites data may be REE-controlled, treated as unknown here.", "TEE_MemMove appends 'len' bytes from data into buf + *blen; src likely caller data (potentially REE-visible) and destination uses runtime blen offset, risk of overflow if bounds not enforced here.", "binding: destination 'buf + *blen' passed as first arg (TEE-private buffer with offset)", "copies 'len' bytes from data into buf+*blen without local validation here; if data is REE-derived this is an unvalidated inbound copy", "Call-site binding: destination 'buf + *blen' is TA buffer offset; arithmetic uses *blen which may be tainted if caller-controlled", "Call-site binding: source 'data' originates from caller/serialargs (potentially REE-visible)", 'Copies data into buf at offset *blen; origin/regions of buf and data ambiguous here causing structural alias risk', 'copies data (likely REE-provided) into buffer at offset *blen; potential unchecked bounds if caller did not validate', "Destination 'buf + *blen' likely points into caller-managed buffer; origin ambiguous but write may extend into REE-visible region depending on buf provenance.", "Source 'data' is caller-provided input; if 'buf' is REE-visible this copy could write REE-visible memory from attacker-controlled source.", 'Copies data (unknown origin, likely REE-visible) into buffer at buf + *blen; destination offset uses *blen (tainted/unchecked index risk)', 'Destination buf + *blen uses dynamic offset; origin/region of buf not established here (unknown)', 'Source data passed into TEE_MemMove likely originates from serialargs/REE at call-site', "Call-site binding: destination buffer ('buf + *blen') and source ('data') origins depend on caller; potential REE->TA copy depending on caller.", "Destination buf + *blen may be REE-visible or shared; source 'data' origin unknown (likely from serialargs) and length 'len' is caller-controlled.", 'data (likely from REE) is copied into buf+*blen using len without shown bounds check here', "Copies 'data' into buffer at buf + *blen (possible append); origin of 'data' and bounds of buf depend on caller and are uncertain", 'destination pointer buf + *blen aliases caller-managed buffer (bstart) and is mutated after realloc, creating aliasing of caller buffer into internal region', 'data pointer and len (often derived from upstream REE-provided template) are copied into destination without further validation of content or expected type', 'length argument len is caller-controlled (propagated from template parsing) and is forwarded to memmove, affecting allocation and copy size', "Copies 'len' bytes from caller-controlled data into reallocated buffer; though overflow check exists, data length is caller-controlled and realloc may succeed with large allocations", 'Call-site binding: destination pointer is buffer returned by TEE_Realloc (TA-private) computed from bstart/*blen', "Call-site binding: source 'data' originates from parsed attribute stream (influenced by REE input)", "Copies caller-controlled 'len' bytes into reallocated buffer; although ADD_OVERFLOW checks integer overflow, 'len' is untrusted and may cause excessive allocation or logic issues", "Copies caller-controlled 'len' bytes into reallocated buffer; overflow check present but no policy upper-bound on 'len'.", 'TEE_MemMove copies caller-controlled data into reallocated buffer without validating data content or checking that data pointer is valid for len bytes', 'alias of destination pointer (buf + *blen) passed into TEE_MemMove; destination is TA heap buffer derived from caller-managed bstart', 'alias of source data pointer passed into TEE_MemMove; data may point into REE-provided buffers parsed earlier', "TEE_MemMove copies caller-controlled data pointer for len bytes without validating that 'data' is valid for 'len' or that len is within expected provenance", "destination pointer is an alias into a realloc'd buffer computed in caller; record binding of callee dest to caller-owned buffer (TEE-private)", "copies 'len' bytes from caller-provided 'data' into internal buffer; 'len' originates from higher-level input and lacks an application-level upper bound check here", "binds callee 'data' parameter to caller-origin 'data' pointer (may be heap or REE-derived); record origin", 'TEE_MemMove writes len bytes at buf + *blen after realloc; reliance on ADD_OVERFLOW and realloc success provides safety but write uses caller-controlled *blen and len', 'Destination buffer (buf + *blen) is derived from caller-managed bstart and updated via realloc; write target provenance links caller buffer into this copy', "Source pointer 'data' may originate from allocated TEE attribute buffers or local temporaries (e.g., a_ptr or &data32) and is copied into buf", 'The copy uses caller-controlled *blen and len; safety depends on prior ADD_OVERFLOW and successful realloc—no explicit runtime check at the copy site', 'Copy uses caller-controlled *blen and len; safety depends on earlier overflow check and successful realloc.', "destination buffer 'buf + *blen' is alias of realloc'd bstart which originates from attribute buffer (caller-influenced); reallocation then used as copy target", "source 'data' may be caller-controlled (either local data32 or a TEE-allocated a_ptr); origin depends on callsite", "length 'len' (copy size) is used to bound the copy after realloc; although integer-overflow and alloc checks exist, no semantic check ensures 'len' matches expected attribute capacity", "length 'len' is used to bound the copy after realloc; semantic validation that 'len' matches expected attribute capacity is missing", 'bstart-derived buffer (head-derived) is reallocated and used as destination; origin of bstart at call-site ties to upstream REE-derived templates.', 'blen (buf_len) at call-site is updated and used to compute destination offset; initial blen derived from (*head)->attrs_size (upstream).', 'copies caller-provided data into TA-managed buffer without semantic validation of data contents (data originates from REE).', 'destination pointer is buf + *blen into TA-allocated buffer (result of TEE_Realloc); binds callee dest to TA-private buffer used as serialization target', "copies 'data' of length len into buffer; 'data' may originate from REE (e.g., EC_PARAMS via a_ptr) and len is caller-controlled without semantic validation", "copies caller-controlled 'data' of length 'len' into buffer at offset *blen; although integer overflow and allocation are checked, there is no explicit validation of 'len' relative to expected attribute semantics", "destination pointer is alias into TA-allocated buffer 'buf' produced by TEE_Realloc; binding buf+*blen into copy", "source 'data' may originate from REE (caller-provided attribute payload) and is passed into TEE_MemMove", "copies caller-controlled data of length 'len' into TA buffer at offset *blen; although overflow and allocation are checked, there is no semantic validation of 'len' vs expected attribute semantics", "copies caller-controlled data of length 'len' into TA buffer; lacks attribute-specific length validation though integer overflow/allocation are checked."]

ルール: other, weak_input_validation, shared_memory_overwrite

['TEE_MemMove(buf + *blen, data, len);']

関数: ['=']

場所: /workspace/vuln-ta-collection/optee-pkcs11-cve/ta/attributes.c:49

フェーズ: ['unknown']

詳細: ['data pointer passed into serialize originates from caller (may point into REE-provided buffer parsed earlier)']

ルール: other

['rc = serialize(bstart, &buf_len, data, size);']

関数: ['=']

場所: /workspace/vuln-ta-collection/optee-pkcs11-cve/ta/handle.c:64

フェーズ: ['unknown']

詳細: ["Destination pointer is db->ptrs + db->max_ptrs (TA-managed buffer) passed into MemFill; length derived from db fields used to initialize newly realloc'd region."]

ルール: other

['TEE_MemFill(db->ptrs + db->max_ptrs, 0, (new_max_ptrs - db->max_ptrs) * sizeof(void *));']

関数: ['=']

場所: /workspace/vuln-ta-collection/optee-pkcs11-cve/ta/processing.c:376

フェーズ: ['unknown']

詳細: ['data pointer (a_ptr) passed in originates from TEE alloc_get_tee_attribute_data (TEE-private) and is copied into attribute list']

ルール: other

['rc = add_attribute(head, pkcs11_id, a_ptr, a_size);']